EUVD-2026-38777
GHSA-hrmj-8fm9-cg8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable Pipeline step with low complexity but requires Item/Configure (PR:L); arbitrary controller file read plus vendor-noted RCE path justifies C:H/I:H/A:H.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.
Articles & Coverage 2
AnalysisAI
Path traversal in the Jenkins External Workspace Manager Plugin (versions 1.3.2 and earlier) lets an attacker with Item/Configure permission supply traversal sequences in the custom workspace path of the exwsAllocate Pipeline step to read arbitrary files from the Jenkins controller filesystem, which the vendor notes can escalate to remote code execution. The flaw requires an authenticated low-privileged user (CVSS:3.1 PR:L, base 8.8) and is reported directly by the Jenkins security team. No public exploit identified at time of analysis, and CISA SSVC marks exploitation as none.
Technical ContextAI
The vulnerability is a CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the exwsAllocate Pipeline step, part of the External Workspace Manager Plugin used to share workspaces across Jenkins agents and the controller. The plugin accepts a user-controlled custom workspace path but fails to canonicalize or reject '../' sequences, so a crafted path escapes the intended workspace root and resolves to arbitrary locations on the controller. Because Jenkins pipeline steps execute in the context of the controller and the controller stores secrets, credentials, and the ability to define build logic, arbitrary file read on the controller is a stepping stone toward remote code execution (e.g., reading credential stores or secret keys). The affected component is identified by CPE cpe:2.3:a:jenkins_project:jenkins_external_workspace_manager_plugin:*.
RemediationAI
Apply the fix described in the Jenkins security advisory SECURITY-3777 (https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3777); the input data does not include an exact fixed version number, so treat the patch as 'available per vendor advisory' and upgrade to the version designated as fixed in that advisory rather than an assumed number. If immediate patching is not possible, reduce exposure by restricting Item/Configure permission to a minimal set of trusted users and audit existing pipeline definitions for use of the exwsAllocate step, since the attack requires the ability to configure jobs - tightening this RBAC permission directly removes the attacker prerequisite but may slow developer self-service. As a further compensating control, avoid granting the External Workspace Manager Plugin to projects that do not require shared workspaces and consider disabling or uninstalling the plugin where unused, accepting the trade-off that any pipelines relying on exws steps will break.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today