GitHub Advisoryadvisory · Maven

GHSA-r6qv-frpc-q66c Jenkins has a link following vulnerability allows arbitrary file creation

HIGH Published 2026-03-18 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-33001
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-59, CWE-61
Reviewed
2026-03-19

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.555 → fixed in 2.555

Description

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

Related

Alias · CVE (1)

  • CVE-2026-33001 Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz… vulnerability

Weakness · CWE (2)

  • CWE-59 Improper Link Resolution Before File Access weakness
  • CWE-61 UNIX Symbolic Link (Symlink) Following weakness

References