GitHub Advisoryadvisory · Maven

GHSA-qxh4-j39m-qfx4 Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability

MEDIUM Published 2025-12-10 Modified 2025-12-10 Official page ↗
Aliases
CVE-2025-67643
Ecosystem
Maven
Packages
org.jenkinsci.plugins:pipeline-reporter-by-redpen
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2025-12-10

Affected packages

• Maven org.jenkinsci.plugins:pipeline-reporter-by-redpen: <= 1.054 (no fix yet)

Description

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

Related

Alias · CVE (1)

  • CVE-2025-67643 Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References