CVE-2026-92131: Path Traversal
Jenkins Pipeline: Groovy Libraries Plugin 805.vafc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict write/configuration access that allows attackers to configure Jenkins Pipelines (e.g., limit who can create or modify Pipelines that use the Pipeline library step) so an attacker cannot abuse the Groovy Libraries Plugin path traversal to read/delete files on the Jenkins controller.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to configure Jenkins Pipelines and provide a library path to the library Pipeline step. The impact is on the Jenkins controller file system.
What file-system access can exploitation provide?
An attacker can read files through a resources directory and delete files through a test directory on the Jenkins controller. The vulnerable plugin accepts paths outside the SCM checkout and follows symbolic links to those locations.
Are installations using symbolic links at additional risk?
Yes. The plugin follows symbolic links when retrieving a library, including links that resolve outside the SCM checkout, enabling traversal to controller file-system locations.