CVE-2026-70427

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2

Description Jenkins fails to safely handle symbolic links with effectively empty names when extracting .tar and .tar.gz archives. This allows attackers who control agent processes to provide specially crafted archives to the controller, enabling them to write files to arbitrary locations on the file system, limited only by the file system access permissions of the user running Jenkins.

Recommendations Update Jenkins to version 2.576 or later. Update Jenkins LTS to version 2.568.2 or later.