CVE-2026-117617 in Jenkins
Summary
by MITRE • 10/28/2026
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Jenkins versions 2.587 and earlier, as well as LTS version 2.580.1 and earlier, represents a critical path traversal flaw rooted in improper handling of symbolic links during artifact extraction processes. This security defect allows attackers possessing Item or Configure permissions to execute arbitrary file writes on the Jenkins controller's file system. The core technical issue lies in the timing of the validation logic used when processing uploaded artifacts. Specifically, the software performs checks for symbolic links only at the stage prior to creating parent directories within the target path structure. It fails to re-validate these paths immediately before writing data into the final destination files or empty directories. This temporal gap creates a race condition window where an attacker can manipulate the file system state between the initial check and the actual write operation, effectively bypassing security controls designed to prevent directory traversal attacks.
From a technical perspective, this flaw aligns with CWE-59 Improper Link Resolution Before File Access commonly known as TOCTOU or Time-of-check to time-of-use vulnerabilities. The Jenkins controller relies on the assumption that the file system structure remains static between the validation step and the execution of the write operation. However, because symbolic links can be created or modified by other processes or users with appropriate permissions during this interval, an attacker can redirect a seemingly safe path to point toward sensitive areas of the operating system. By exploiting this mechanism, malicious actors can overwrite existing files or create new ones in arbitrary locations outside the intended artifact storage directory. This capability transforms what might appear as a simple file upload feature into a powerful vector for achieving unauthorized write access across the host environment.
The operational impact of this vulnerability is severe due to its potential to lead to full system compromise. An attacker who successfully exploits this flaw can overwrite critical configuration files, inject malicious scripts, or replace executable binaries on the Jenkins controller. Since the Jenkins controller typically runs with elevated privileges necessary for managing build agents and executing pipelines, gaining write access to arbitrary locations often translates directly into remote code execution capabilities. This allows the adversary to escalate their privilege level from a limited user account within the application to root or system-level access on the underlying operating system. Consequently, this can result in data exfiltration, persistence mechanisms being established via cron jobs or systemd services, and lateral movement across the network if other systems are accessible from the compromised controller.
This vulnerability is closely associated with ATT&CK technique T1059 Command and Scripting Interpreter through indirect command execution via file manipulation, as well as T1204 User Execution if combined with social engineering to trick users into uploading malicious artifacts. The exploitation chain typically involves an authenticated user creating a Jenkins job or pipeline that accepts external input, such as from version control systems or other CI/CD tools. By carefully crafting the artifact metadata and leveraging the symbolic link race condition, the attacker redirects writes to sensitive paths like /etc/cron.d for persistence or overwrites application binaries to trigger code execution upon restart. The lack of immediate pre-write validation is a fundamental design oversight that undermines the integrity controls intended by Jenkins' security model.
Mitigation strategies must prioritize upgrading the Jenkins instance immediately if it falls within the affected version ranges, specifically ensuring updates beyond 2.587 for standard releases and LTS versions beyond 2.580.1 are applied. These updated versions implement stricter validation logic that checks symbolic links immediately before any file write operation occurs, thereby closing the race condition window. In environments where immediate patching is not feasible due to operational constraints, administrators should enforce strict least-privilege principles by restricting Item and Configure permissions only to trusted users who require them for their specific roles. Additionally, deploying a Web Application Firewall with rules capable of detecting anomalous file system access patterns or symbolic link manipulations can provide an additional layer of defense. Regular auditing of Jenkins job configurations and artifact sources further reduces the attack surface by ensuring that no untrusted inputs are processed through vulnerable extraction mechanisms.