UNKNOWN NVD

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not i

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4248

Published: 2026-10-28 · Source: NVD · Feed updated: 2026-10-28

This unknown severity vulnerability was published on 2026-10-28 via NVD.

vulnfeed aggregates 14990 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.