Linux Foundation Jenkins up to 2.555.3 Tar Extraction FilePath.java symlink

Summaryinfo

A vulnerability, which was classified as problematic, was found in Linux Foundation Jenkins up to 2.555.3. Affected is an unknown function of the file FilePath.java of the component Tar Extraction. Such manipulation leads to symlink. This vulnerability is uniquely identified as CVE-2026-19429. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Foundation Jenkins up to 2.555.3. Affected by this issue is some unknown functionality of the file FilePath.java of the component Tar Extraction. The manipulation with an unknown input leads to a symlink vulnerability. Using CWE to declare the problem leads to CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. Impacted is confidentiality. CVE summarizes:

An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-19429 since 08/10/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 08/10/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Continuous Integration Software

Vendor

• Linux Foundation

Name

• Jenkins

Version

• 2.555.0
• 2.555.1
• 2.555.2
• 2.555.3

License

• open-source

Website

• Vendor: https://www.linuxfoundation.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion