Trung Pham

The issue allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. This is due to the plugin not restricting the path of files in a method implementing form validation. The plugin allows specifying files in the `userContent/` directory for use as link icons.

The issue allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. This is due to the lack of restriction on the name and resulting uploaded file name of Stashed File Parameters.

The issue is related to a stored cross-site scripting (XSS) vulnerability. This occurs because the LoadComplete test name is not properly escaped, allowing attackers with Item/Configure permission to exploit this weakness. The vulnerability is present in the test result page.

The issue arises from improper handling of the filename directive in the Content-Disposition header, specifically when the filename contains a NULL character, leading to filename truncation. This could facilitate reflected file download attacks, potentially tricking users into installing malware.

The issue allows for an arbitrary file write, which can be achieved by using a specially crafted zip archive, as well as other archives such as bzip2, tar, xz, war, cpio, and 7z. These archives can contain path traversal filenames. When the filename is concatenated to the target extraction directory, the final path can end up outside of the target folder.