CVE-2026-70427 in Jenkins
Summary
by MITRE • 08/05/2026
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability affects Jenkins versions prior to 2.575 and LTS versions prior to 2.568.1, specifically targeting the handling of symbolic links during archive extraction processes. The flaw occurs when Jenkins processes tar and tar.gz archives containing symbolic links with effectively empty names, creating a path traversal condition that can be exploited by attackers who control agent processes. The vulnerability stems from insufficient validation of archive contents during extraction, allowing maliciously crafted archives to bypass normal security boundaries.
The technical implementation involves the improper handling of symbolic link names within archive extraction logic where empty or null name entries are not properly sanitized before file system operations are executed. When Jenkins encounters such malformed symbolic links, it fails to validate whether the target path is safe for creation or modification, leading to potential arbitrary file write operations. This behavior violates secure coding principles and represents a classic path traversal vulnerability that can be leveraged to overwrite critical system files or inject malicious content into the Jenkins environment.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows attackers with agent process control to execute arbitrary file system operations on the Jenkins controller. Since the attack vector requires only the ability to control an agent process, the threat surface is significant in environments where multiple agents are deployed. The restriction to file system permissions of the running user provides some mitigation but does not eliminate the risk entirely, as attackers could still overwrite files within the Jenkins user's authorized scope or potentially escalate privileges through other means.
This vulnerability aligns with CWE-22 Path Traversal and CWE-73 Improper Neutralization of Special Elements in Output Used by a Downstream Component, representing a failure in input validation and output sanitization. From an ATT&CK perspective, this maps to T1059 Command and Scripting Interpreter and T1566 Phishing, as attackers could leverage this vulnerability to establish persistence or escalate privileges within the Jenkins environment. The exploitation requires minimal prerequisites beyond agent access, making it particularly dangerous in multi-agent deployments.
Mitigation strategies should focus on immediate version upgrades to patched Jenkins releases that properly validate symbolic link names during archive extraction. Organizations should also implement strict network segmentation between Jenkins controllers and untrusted agents, employ additional monitoring for unusual file system activity, and consider implementing automated patch management processes. The recommended approach includes disabling unnecessary agent capabilities, restricting agent-to-controller communication, and conducting regular security audits of Jenkins configurations to identify potential attack vectors that could be exploited in conjunction with this vulnerability.