CVE-2026-117626: Path Traversal
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINSHOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit the issue, and what information can they access?
Users with Overall/Read permission can obtain file names, sizes, and last modification times for files in $JENKINS_HOME. Users with Item/Workspace permission can obtain the names of jobs with a workspace on the same agent.
Does exploitation expose file contents?
The reported impact is limited to file metadata for $JENKINS_HOME and job names for workspaces on the same agent; the provided information does not state that file contents can be read.
Which Jenkins releases are affected?
Jenkins 2.587 and earlier and Jenkins LTS 2.580.1 and earlier are affected.