Log in Start free

Vulnerability · Published Mar 18, 2026 · Assigned by jenkins

CVE-2026-33001

High 8.8

In plain English

A high-severity path traversal in Jenkins from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.1%top 18.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.jenkins-ci.main:jenkins-core2.555GHSA-r6qv-frpc-q66c

Affected products (as reported)

VendorProductVersions
Jenkins Project Jenkins see references

Weakness: CWE-59, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References