CVE-2026-57296

Name of the Vulnerable Software and Affected Versions Jenkins External Workspace Manager Plugin versions prior to 1.3.3

Description The plugin fails to reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step. This allows attackers with Item/Configure permissions to read arbitrary files on the Jenkins controller file system, which may lead to remote code execution. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations Update Jenkins External Workspace Manager Plugin to version 1.3.3 or later. As a temporary mitigation, restrict Item/Configure permissions to trusted users only.