CVE-2026-33001
EUVD-2026-1284318.03.2026, 16:16
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| jenkins | jenkins | 𝑥 < 2.541.3 |
| jenkins | jenkins | 𝑥 < 2.555 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | OpenShift Developer Tools and Services 4.12 | 1776764096 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.13 | 1776764096 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.14 | 1776762347 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.15 | 1776762347 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.16 | 1776944215 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.17 | 1776944215 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.18 | 1776944215 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.19 | 1776944215 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.2 | 1776944215 ≤ 𝑥 < * | ADP |
| Red Hat | OpenShift Developer Tools and Services 4.21 | 1776944215 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
References