Vulnerability · Published Sep 2, 2026 · Assigned by jenkins
CVE-2026-84669
High 8.8
In plain English
A high-severity path traversal in Jenkins Allure Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 53.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins Allure Plugin | 0 – through 2.35.2 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Jenkins Security Advisory 2026-09-02 vendor-advisory