CVE-2026-70428: Path Traversal

Q: What is the severity of CVE-2026-70428?

The severity of CVE-2026-70428 is rated as 55.

Q: How do I fix CVE-2026-70428?

To fix CVE-2026-70428, upgrade your Jenkins installation to version 2.576 or later.

Q: What is the impact of CVE-2026-70428?

CVE-2026-70428 allows attackers with specific permissions to write files to arbitrary locations on the Jenkins controller file system.

Q: Which versions of Jenkins are affected by CVE-2026-70428?

Jenkins versions 2.575 and earlier, as well as Jenkins LTS versions 2.568.1 and earlier, are affected by CVE-2026-70428.

Q: What type of vulnerability is CVE-2026-70428 classified as?

CVE-2026-70428 is classified as a path traversal vulnerability.

Published Aug 5, 2026

Updated

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

Affected Software

4 affected components

Jenkins Jenkins>2.575<=2.575, <=2.575

Jenkins Jenkins LTS<=2.568.1

Jenkins Jenkins<2.568.2

Jenkins Jenkins<2.576

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Jenkins to a version that resolves this vulnerability.
Fixed in 2.575
Upgrade
Upgrade Jenkins LTS to a version that resolves this vulnerability.
Fixed in 2.568.1

Event History

Aug 5, 2026

CVE Published

via MITRE·05:40 PM

Data Sourced

via MITRE·05:40 PM

Description

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-70428?

The severity of CVE-2026-70428 is rated as 55.

How do I fix CVE-2026-70428?