Jenkins Redpen Plugin
CVE-2025-67643
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Item/Configure permission
-
DeliveryCraft malicious workspace path in artifact upload config
-
ExploitBypass path validation during Jira upload
-
ExecutionRetrieve controller workspace files
-
ImpactDisclose sensitive file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Jenkins user holding Item/Configure permission (PR:L) on an instance where the Redpen - Pipeline Reporter for Jira plugin (version 1.054.v7b_9517b_6b_202 or earlier) is installed and used to upload artifacts to Jira. The flaw is reachable over the network via the Jenkins web interface with no user interaction, but it is strictly limited to users who can configure jobs - it cannot be triggered anonymously or by read-only users. Impact is bounded to reading files from the Jenkins controller's workspace directory (confidentiality only); no write or denial-of-service capability is implied. |
| Impact | This is a genuinely moderate-to-low priority issue, and the multiple signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable but authenticated flaw with only limited confidentiality impact and no integrity or availability effect - consistent with the description, which limits exploitation to attackers already holding Jenkins Item/Configure permission. The EPSS score is low (0.34%, 26th percentile), the vulnerability is NOT in CISA KEV, and there is no public exploit code identified at the time of analysis, so there is no public exploit identified at time of analysis. No signals conflict: the low EPSS, absence of KEV, and the PR:L authentication requirement all point the same direction. The main realistic risk is an insider or a lower-privileged-but-configure-capable user reading files from the Jenkins controller workspace they should not access. This is a real but contained information-disclosure issue, not a high-urgency remote-code-execution or unauthenticated-exposure scenario. |
| Exploit ScenarioDerived | An attacker who already holds Item/Configure permission on a Jenkins instance running the Redpen - Pipeline Reporter for Jira plugin configures a job to upload artifacts to Jira using a crafted workspace path that escapes the intended directory. Because path validation of the workspace directory is not correctly performed, the plugin retrieves and discloses arbitrary files from the Jenkins controller's workspace directory. No public exploit code is identified at the time of analysis, and exploitation requires valid authenticated access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authenticated path traversal in the Jenkins Redpen - Pipeline Reporter for Jira plugin (1.054.v7b_9517b_6b_202 and earlier) allows a user holding Item/Configure permission to read files from the Jenkins controller workspace directory when the plugin uploads build artifacts to Jira. Because the plugin fails to correctly validate the workspace path, the file being attached to a Jira issue can be resolved outside the intended build workspace, exposing controller-side files to anyone who can configure a job. No public exploit code has been identified at time of analysis, there is no indication of active exploitation, and the EPSS score is low at 0.34% (26th percentile), so this is a moderate-to-low priority issue whose risk is driven mainly by the privileged permission required of the attacker.
RemediationAI
No fixed version is specified in the available data, so the first step is to consult the Jenkins security advisory at https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3290 and upgrade the Redpen - Pipeline Reporter for Jira plugin to whatever patched release it names; the advisory is the only vendor-supplied source here, and the absence of a stated fix version should not be read as confirmation that none exists. If an upgrade is not immediately possible, disable or uninstall the plugin on controllers where artifacts are not being pushed to Jira - this fully removes the attack surface at the cost of losing that reporting integration. Where the plugin must remain, restrict Item/Configure permission to a minimal, trusted set of users (the traversal requires that permission and cannot be triggered anonymously or by read-only users), review which Jenkins credentials the plugin uses to reach Jira and scope them to the least privilege necessary, and avoid hosting sensitive files in or near the controller workspace directory since the flaw only reads controller-side workspace content. These compensating controls reduce exposure but do not eliminate the underlying path validation defect, so patching remains the durable fix.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory ('path traversal') in a Jenkins plugin. The Redpen - Pipeline Reporter for Jira plugin collects build artifacts from a job's workspace and attaches them to Jira issues; when resolving the artifact path it performs insufficient validation of the workspace directory, so crafted path data can cause file reads outside the intended workspace and within the Jenkins controller's workspace directory. CPE data (cpe:2.3:a:jenkins:redpen_-_pipeline_reporter_for_jira:*:*:*:*:*:jenkins:*:*) confirms the affected component is the Jenkins plugin distribution rather than the Jira server itself, and the wildcarded version reflects that all releases up to and including 1.054.v7b_9517b_6b_202 are in scope. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N shows the attack is network-reachable through the Jenkins web UI without user interaction, but is gated behind low-privilege authentication and yields only limited confidentiality loss - no integrity or availability impact - which is consistent with a read-only file disclosure rather than code execution.
Know when Redpen Pipeline Reporter For Jira gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable via Jenkins UI (AV:N) but requires Item/Configure permission (PR:L); only limited file disclosure so C:L, with no integrity or availability impact.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
GitHub PoC
Exploit-DB