CVE-2026-70427

4.3 Moyenne

Publiée le 05/08/2026 à 20:17 · Modifiée le 08/09/2026 à 22:17 · Analysée par le NVD · Source : jenkinsci-cert@googlegroups.com

Description

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.

Traduire en français

Produits concernés

Jenkins Project Jenkins
Jenkins jenkins

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-59

Références

https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories