CVE-2026-70427

Katalog CVE

CVSS 4.3 · Medium EPSS 0,43%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada jenkins. Skor CVSS 3.1 4.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.

Rincian

Terbit di NVD

5 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930 advisory vendor