8.8

CVE-2026-33001

Medienbericht
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.
This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jenkins ≫ Jenkins SwEditionlts Version < 2.541.3
Jenkins ≫ Jenkins SwEdition- Version < 2.555
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.16% 0.632
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 8.8 2 6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
23.03.2026 15:22
https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:10199
https://access.redhat.com/errata/RHSA-2026:10201
https://access.redhat.com/errata/RHSA-2026:10204
https://access.redhat.com/errata/RHSA-2026:10205
https://access.redhat.com/errata/RHSA-2026:10206
https://access.redhat.com/errata/RHSA-2026:10209
https://access.redhat.com/errata/RHSA-2026:10211
https://access.redhat.com/errata/RHSA-2026:10213
https://access.redhat.com/errata/RHSA-2026:10214
https://access.redhat.com/errata/RHSA-2026:10215
https://access.redhat.com/security/cve/CVE-2026-33001
https://bugzilla.redhat.com/show_bug.cgi?id=2448645
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33001.json