CVE-2026-19429

Name of the Vulnerable Software and Affected Versions Jenkins Project Jenkins versions prior to LTS 2.555.3

Description An incomplete patch allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem. The issue exists because the untarFrom() function validates symlink destinations during tar extraction in FilePath.java but fails to validate symlink targets. A symlink located inside the workspace can point to arbitrary paths outside of it, enabling the disclosure of sensitive files readable by the Jenkins process user, such as secrets/master.key, credentials.xml, and other configuration files. Exploitation can occur if an administrator points a tool installer, such as DownloadFromUrlInstaller or ZipExtractionInstaller, to an attacker-controlled URL. Subsequently, a request to the endpoint '/job/{name}/build' extracts the malicious tar archive and plants symlinks in the tool cache. Sensitive data is then exposed via the endpoints '/job/{name}/lastBuild/consoleText' or '/job/{name}/ws/{file}', potentially revealing files like /etc/passwd.

Recommendations Update Jenkins Project Jenkins to a version later than LTS 2.555.3.