Arbitrary file write via symlink in tar extraction in Jenkins (CVE-2026-70427)

Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) does not safely handle symbolic links with effectively empty names during extraction of `.tar` and `.tar.gz` archives. Attackers able to control agent processes can supply crafted archives to the controller, writing files to arbitrary locations on the file system restricted only by the OS-level permissions of the Jenkins process user. This can result in remote code execution, for example by writing malicious scripts to `JENKINS_HOME/init.groovy.d/` or deploying malicious plugins to `JENKINS_HOME/plugins/`. Affected versions: - Jenkins 2.575 and earlier - Jenkins LTS 2.568.1 and earlier We recommend updating to: Jenkins 2.576, Jenkins LTS 2.568.2. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/438 Details: https://vuln.today/cve/CVE-2026-70427