GHSA-83x3-qgq9-rfcqCriticalCVSS 8.8
Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets,...
🔗 CVE IDs covered (1)
📋 Description
Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers tar extraction via POST /job/{name}/build, writing persistent symlinks into the tool cache. Symlinks to secrets/master.key, hudson.util.Secret, credentials.xml, and users/*/config.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all credentials and admin API tokens without bcrypt cracking, achieving RCE.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-19429
- https://github.com/jenkinsci/jenkins
- https://www.jenkins.io/security/advisories/2026-03-19
- https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657
- https://www.jenkins.io/security/advisory/2026-08-05
- https://github.com/advisories/GHSA-83x3-qgq9-rfcq