CVE-2026-117626 in Jenkins
Summary
by MITRE • 10/28/2026
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as CVE-2024-23897 represents a critical path traversal flaw within Jenkins versions 2.587 and earlier, including LTS release 2.580.1 and prior iterations. This security defect resides specifically in the file browser functionality designed for accessing workspaces and the $JENKINS_HOME/userContent/ directory. The core technical issue stems from an improper validation of user-supplied input when constructing file paths. Instead of strictly sanitizing or canonicalizing the requested path to ensure it remains within the intended sandboxed directories, Jenkins fails to adequately restrict access boundaries. This allows attackers to manipulate the file system navigation logic by injecting sequence characters that traverse upward in the directory hierarchy, effectively breaking out of the restricted context into broader areas of the server's file system.
From an operational perspective, this vulnerability enables unauthorized information disclosure based on the level of permission held by the attacker within the Jenkins environment. For users possessing only Overall/Read permissions, which are typically granted to lower-level contributors or auditors who should have limited visibility, the flaw allows them to enumerate files located in the root $JENKINS_HOME directory. By exploiting this path traversal, these attackers can retrieve sensitive metadata including file names, sizes, and last modification timestamps. This information gathering is particularly dangerous as it aids in reconnaissance for subsequent attacks, such as identifying configuration files that may contain credentials or secrets used by other jobs.
Furthermore, the impact extends to users with Item/Workspace permissions. While this role is generally intended to allow developers to manage specific job workspaces, the vulnerability permits them to enumerate the names of any jobs that maintain a workspace on the same agent node as their own. This cross-job visibility violates the principle of isolation between different projects and teams within a Jenkins instance. Attackers can use this data to map out the infrastructure's project structure, identify high-value targets for further exploitation, or correlate build activities across unrelated pipelines, thereby compromising the integrity and confidentiality of multiple independent software development workflows hosted on the same server.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where an application does not properly neutralize special elements within file paths that can cause files to be located outside of the intended directory. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1083: File and Directory Discovery, specifically under the sub-technique for Linux or Unix systems when Jenkins is deployed on such platforms. The exploitation relies on basic file system navigation techniques that do not require complex payload construction but rather precise manipulation of directory traversal sequences like dot-dot-slash patterns to bypass access controls.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Organizations running affected versions should upgrade Jenkins to version 2.587 or later, or LTS version 2.580.2 and above, where this path validation logic has been corrected. In environments where upgrading is not immediately feasible due to compatibility constraints with plugins or custom scripts, administrators can implement network-level controls such as firewall rules to restrict access to the Jenkins web interface from untrusted networks. Additionally, enforcing strict least-privilege principles by auditing user roles and removing unnecessary Overall/Read permissions for users who do not require global visibility can significantly reduce the attack surface. Regular monitoring of audit logs for unusual file system access patterns or repeated attempts to traverse directories may also help in detecting exploitation attempts before significant data exfiltration occurs.