PT-2025-50361

CVE-2025-67643

Published

2025-12-10

Updated

2025-12-14

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Redpen - Pipeline Reporter for Jira Plugin versions 1.054.v7b 9517b 6b 202 and earlier

Description The Jenkins Redpen - Pipeline Reporter for Jira Plugin does not properly validate file paths within the workspace directory during artifact uploads to Jira. This allows individuals with Item/Configure permissions to access files located on the Jenkins controller's workspace directory. The issue arises from insufficient path validation, potentially enabling unauthorized file retrieval.

Recommendations Update Jenkins Redpen - Pipeline Reporter for Jira Plugin to a version later than 1.054.v7b 9517b 6b 202.

Exploitability

Fix

Impacts

Researchers

Yaroslav Afenkin

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2025-67643