Vulnerability · Published Sep 16, 2026 · Assigned by jenkins

CVE-2026-92131

Medium 4.2

In plain English

A medium-severity path traversal in Jenkins Pipeline: Groovy Libraries Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 86.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system.

Affected products (as reported)

Vendor	Product	Versions
Jenkins Project	Jenkins Pipeline: Groovy Libraries Plugin	0 – through 805.va_fc79344957d

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

Jenkins Security Advisory 2026-09-16 vendor-advisory