CVE-2026-70428

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2

Description Improper identification of file paths attempting path traversal in file parameter names allows attackers with Item/Configure and Item/Build permissions to write files to arbitrary locations on the controller file system. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations Update Jenkins to version 2.576 or later. Update Jenkins LTS to version 2.568.2 or later.