CVE-2026-70427: Medium severity Jenkins Jenkins vulnerability
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkinsto a version that resolves this vulnerability.Fixed in 2.575 - Upgrade
Upgrade
Jenkins LTSto a version that resolves this vulnerability.Fixed in 2.568.1 - Compensating control
Ensure attackers cannot control agent processes or submit crafted `.tar`/`.tar.gz` archives to the Jenkins controller (restrict who can run/submit agent content to the controller).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70427?
CVE-2026-70427 has been assigned a risk level of 50, indicating a moderate vulnerability.
How do I fix CVE-2026-70427?
To mitigate CVE-2026-70427, update Jenkins to version 2.576 or later, or LTS version 2.569.1 or later.
What are the potential impacts of CVE-2026-70427?
CVE-2026-70427 could allow attackers to write files to arbitrary locations on the Jenkins controller via crafted `.tar` or `.tar.gz` archives.
Which versions of Jenkins are affected by CVE-2026-70427?
Jenkins versions 2.575 and earlier and LTS version 2.568.1 and earlier are affected by CVE-2026-70427.
What type of attack is associated with CVE-2026-70427?
CVE-2026-70427 is associated with attacks that exploit improper handling of symbolic links during archive extraction.