CVE-2026-117617

HighCVSS 8.1/10Last modified Nov 5, 2026

Description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2026
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1176188.1In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setuCVE-2026-1176198.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API tokeCVE-2026-1176208.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old DataCVE-2026-1176216.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file anCVE-2026-1176226.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the cCVE-2026-1176235.4Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, rCVE-2026-1176248.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked asCVE-2026-1176254.3A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain theCVE-2026-1176264.3Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspCVE-2026-1176275.4A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider CVE-2026-117636.5Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software ServiceCVE-2026-1176356.5The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scop
CVE-2026-117617: High severity, CVSS 8.1 | Vulnix