CVE-2026-70428CWE-22path-traversal

CVE-2026-70428

Medium · published August 5, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-05T22:17Z
Affected products (2)
ProductVersionsFixed in
jenkins/jenkins< 2.568.22.568.2
jenkins/jenkins< 2.5762.576
References (1)
https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927 · [email protected]
EPSS history
Timeline
  • 05 AUG 17:40Z
    Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with…
    cvelistv5