What is the CVSS score of CVE-2026-70428?

CVE-2026-70428 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Jenkins CVE-2026-70428

EUVD-2026-53571 MEDIUM

Path Traversal (CWE-22)

2026-08-05

GHSA-c232-r242-w9v9

Path Traversal Jenkins

4.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

9.9 CRITICAL

Network delivery via Jenkins web interface; Item/Configure and Item/Build are low-privilege grants; scope changes from job context to the controller OS file system enabling code execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:16 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

MEDIUM

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Path traversal in Jenkins file parameter name validation allows authenticated attackers holding Item/Configure and Item/Build permissions to write arbitrary files to the Jenkins controller's file system, leading to code execution. Affected releases are Jenkins 2.575 and earlier (weekly) and LTS 2.568.1 and earlier; fixed in Jenkins 2.576 and LTS 2.568.2, published 2026-08-05. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Jenkins supports file parameters in build job definitions, allowing builds to receive uploaded files as inputs. The flaw (CWE-22, Improper Limitation of a Pathname) exists in the controller-side logic that validates file parameter names: Jenkins fails to correctly identify path traversal sequences embedded in parameter names, so a crafted name such as '../../init.groovy.d/evil.groovy' is not rejected. Because the resulting write is constrained only by the OS-level file permissions of the user account running the Jenkins process, an attacker can target high-impact paths within JENKINS_HOME, specifically init.groovy.d/ (Groovy scripts executed by Jenkins at startup) and plugins/ (directory scanned for installed plugins). No specific plugin is required; this is a defect in Jenkins core. Affected CPE is not formally enumerated in the provided intelligence, but the advisory clearly scopes this to jenkins/jenkins (the upstream open-source project) versions through 2.575 weekly and 2.568.1 LTS.

RemediationAI

Upgrade to Jenkins 2.576 (weekly) or Jenkins LTS 2.568.2, both of which resolve this path traversal flaw per the official advisory at https://www.jenkins.io/security/advisory/2026-08-05/. Organizations unable to patch immediately should audit and restrict Item/Configure and Item/Build permissions via the Jenkins authorization strategy, granting them only to explicitly trusted users, since exploitation requires both simultaneously. As an additional compensating control, monitor JENKINS_HOME/init.groovy.d/ and JENKINS_HOME/plugins/ for unexpected file additions, as these are the highest-impact write targets identified in the advisory. Removing or disabling file parameter usage from job configurations where not operationally necessary reduces the available attack surface. Note that restricting permissions may impact CI/CD automation workflows and should be coordinated with pipeline owners.