Jamshid

**Name of the Vulnerable Software and Affected Versions** Jenkins Project Jenkins versions prior to LTS 2.555.3 **Description** An incomplete patch allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem. The issue exists because the `untarFrom()` function validates symlink destinations during tar extraction in `FilePath.java` but fails to validate symlink targets. A symlink located inside the workspace can point to arbitrary paths outside of it, enabling the disclosure of sensitive files readable by the Jenkins process user, such as `secrets/master.key`, `credentials.xml`, and other configuration files. Exploitation can occur if an administrator points a tool installer, such as `DownloadFromUrlInstaller` or `ZipExtractionInstaller`, to an attacker-controlled URL. Subsequently, a request to the endpoint '/job/{name}/build' extracts the malicious tar archive and plants symlinks in the tool cache. Sensitive data is then exposed via the endpoints '/job/{name}/lastBuild/consoleText' or '/job/{name}/ws/{file}', potentially revealing files like `/etc/passwd`. **Recommendations** Update Jenkins Project Jenkins to a version later than LTS 2.555.3.