Unrated
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the...
CVE-2026-117615
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins | — | — |
Original description The description as published by the source.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web jenkins.io
- web nvd.nist.gov
- web github.com