Trung Pham

The issue allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. This is due to the plugin not restricting the path of files in a method implementing form validation. The plugin allows specifying files in the `userContent/` directory for use as link icons.

The issue allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. This is due to the lack of restriction on the name and resulting uploaded file name of Stashed File Parameters.

The issue is related to a stored cross-site scripting (XSS) vulnerability. This occurs because the LoadComplete test name is not properly escaped, allowing attackers with Item/Configure permission to exploit this weakness. The vulnerability is present in the test result page.

The issue arises from improper handling of the filename directive in the Content-Disposition header, specifically when the filename contains a NULL character, leading to filename truncation. This could facilitate reflected file download attacks, potentially tricking users into installing malware.

A vulnerabilidade permite a gravação arbitrária de arquivos, o que pode ser feito usando um arquivo zip especialmente criado, bem como outros formatos de arquivo, como bzip2, tar, xz, war, cpio e 7z. Esses arquivos podem conter nomes de arquivos que permitem a traversal de caminho. Quando o nome do arquivo é concatenado ao diretório de extração de destino, o caminho final pode acabar fora da pasta de destino.