CVE-2026-92131

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Libraries Plugin versions prior to 805.va fc79344957d

Description An issue exists where the library path provided to the library Pipeline step is not restricted to a relative path within the SCM checkout. Additionally, the plugin follows symbolic links to locations outside of the SCM checkout during library retrieval. This leads to a path traversal—a method used to access files and directories that are stored outside the web root folder—allowing attackers who can configure Pipelines to read files in a resources directory and delete files in a test directory on the Jenkins controller file system.

Recommendations Update Jenkins Pipeline: Groovy Libraries Plugin to a version later than 805.va fc79344957d.