CVE-2026-84667 in ThinBackup Plugin
Summary
by MITRE • 09/02/2026
Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Jenkins ThinBackup Plugin versions 2.1.4 and earlier stems from a critical flaw in how the plugin handles data binding through the Stapler framework, which is integral to Jenkins' web interface functionality. This specific implementation error allows for improper validation of user-supplied input during the configuration update process. Specifically, the application fails to adequately sanitize or restrict file paths provided by users when modifying backup settings. Because Stapler automatically binds HTTP request parameters to Java object properties without sufficient checks on the nature of those inputs, an authenticated attacker can manipulate these bindings to inject malicious path strings into the plugin's internal configuration objects. This lack of input validation represents a fundamental failure in enforcing security constraints during data processing, directly leading to unauthorized file system interactions that bypass intended operational boundaries.
The technical exploitation of this flaw enables two distinct but related adverse outcomes for an attacker with access to the Jenkins administrative interface or sufficient privileges to modify plugin configurations. First, by manipulating the backup destination path via Stapler data binding, an attacker can redirect where backups are written. This capability allows them to overwrite existing files in arbitrary directories on the Jenkins controller's file system if they possess write permissions to those locations. Second, and more critically for confidentiality, the vulnerability permits the inclusion of arbitrary files from the Jenkins controller into the backup archive. Since the plugin is designed to package specific project data or configuration artifacts, an attacker can exploit this feature to force the extraction and packaging of sensitive system files that were not intended to be part of a standard backup operation. This effectively turns the backup mechanism into a vector for data exfiltration, allowing the attacker to read contents from restricted areas of the server by including them in a downloadable or accessible backup file.
The operational impact of this vulnerability is severe, particularly regarding confidentiality and integrity within the Jenkins ecosystem. By redirecting writes, an attacker could potentially overwrite critical configuration files, such as config.xml or security settings, thereby compromising the integrity of the continuous integration environment. This could lead to service disruption if essential components are corrupted or replaced with malicious content. More significantly, the ability to include arbitrary files in backups poses a substantial risk to data confidentiality. Sensitive information stored on the Jenkins controller, including credentials, private keys, source code repositories, and internal network configurations, can be extracted through this mechanism. If these backup archives are accessible via HTTP or if they are transferred to external storage systems with weaker security controls, the attacker gains persistent access to high-value intellectual property and authentication material that could facilitate further lateral movement within an organization's infrastructure.
From a classification perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation, as the root cause is the failure to verify that user-supplied data conforms to expected formats or constraints before processing. Additionally, it relates to CWE-59 Improper Link Resolution Before File Access, commonly known as path traversal, due to the manipulation of file paths to access unintended resources. In terms of offensive security frameworks, this exploit maps to ATT&CK technique T1083 File and Directory Discovery for gathering information about the system structure, and potentially T1042 Automated Collection if used in conjunction with other tools to harvest data from backups. It also reflects aspects of CWE-798 Use of Hard-coded Credentials if sensitive files containing credentials are targeted for exfiltration.
Mitigation strategies must focus on immediate remediation through software updates and enhanced access controls. The primary defense is to upgrade the Jenkins ThinBackup Plugin to version 2.1.5 or later, where this data binding vulnerability has been patched with stricter input validation mechanisms that prevent arbitrary path manipulation. In environments where upgrading is not immediately feasible, administrators should restrict administrative privileges within Jenkins to only those users who absolutely require them, thereby reducing the attack surface for authenticated attackers. Furthermore, implementing network segmentation and strict file system permissions on the Jenkins controller can limit the impact of any successful exploitation by preventing unauthorized writes or reads outside designated directories. Regular auditing of plugin configurations and monitoring for unusual backup activities can also aid in early detection of such attempts to abuse the backup functionality.