CVE-2026-70428 in Jenkins
Summary
by MITRE • 08/05/2026
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists within Jenkins versions prior to 2.575 and LTS 2.568.1 where the system fails to properly validate file paths in parameter names, creating a path traversal condition that can be exploited by authenticated attackers. The flaw specifically affects the handling of file parameters during build processes, allowing malicious actors with minimal permissions to manipulate file paths and write content to arbitrary locations on the Jenkins controller's file system. The vulnerability stems from inadequate input sanitization mechanisms that do not properly filter or validate special characters such as ../ sequences that could be used to traverse directory structures.
The technical implementation of this weakness allows attackers with Item/Configure and Item/Build permissions to craft malicious file parameter names that bypass normal path validation checks. When Jenkins processes these parameters, it fails to normalize or sanitize the file paths before performing write operations, enabling an attacker to specify absolute paths or manipulate relative paths to target sensitive system directories. This type of vulnerability aligns with CWE-22 Path Traversal and falls under the broader category of improper input validation issues that are commonly exploited in web application security breaches.
The operational impact of this vulnerability is significant as it can lead to arbitrary file writing on the Jenkins controller, potentially enabling attackers to modify critical system files, install malicious code, or exfiltrate sensitive data. Attackers could leverage this vulnerability to compromise the integrity of the build environment, inject backdoors into the Jenkins configuration, or overwrite important binaries and scripts that govern the continuous integration pipeline. The attack vector requires only relatively low privileges within the Jenkins environment, making it particularly dangerous as it can be exploited by users who have legitimate access to configure and trigger builds but should not have unrestricted file system write permissions.
Organizations should immediately upgrade to Jenkins versions 2.575 or later for standard releases and 2.568.1 or later for LTS releases to remediate this vulnerability. Additionally, administrators should implement proper permission controls to limit who can configure and build jobs, ensuring that only trusted personnel have access to these capabilities. Security monitoring should be enhanced to detect unusual file system write activities in Jenkins controller directories, particularly around build artifacts and configuration files. The vulnerability demonstrates the importance of proper input validation and path sanitization in security-critical applications, aligning with ATT&CK technique T1059 Command and Scripting Interpreter and T1486 Data Encrypted for Impact, as it provides attackers with methods to manipulate system resources and potentially escalate their access within the environment.