CVE-2026-33001CWE-22CWE-59path-traversal

CVE-2026-33001

High · published March 18, 2026

CVSS v3.1

8.8

EPSS

Percentile

68.6

In the wild

Unconfirmed

What it is

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.

This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.01225 · 68.6th percentile
Weaknesses: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published: 2026-03-18T20:16Z

Affected products (2)

Product	Versions	Fixed in
jenkins/jenkins	< 2.541.3	2.541.3
jenkins/jenkins	< 2.555	2.555

References (14)

EPSS history

Timeline

18 MAR 15:15Z
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted…
cvelistv5