Vulnerability · Published Sep 2, 2026 · Assigned by jenkins
CVE-2026-84671
High 8.8
In plain English
A high-severity path traversal in Jenkins File Parameter Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 42.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins File Parameter Plugin | 0 – through 425.v3fa_801681b_5e |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Jenkins Security Advisory 2026-09-02 vendor-advisory