EUVD-2026-70137
GHSA-5jp6-w4g2-655c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
File-read-only path traversal: C:H confirmed, but I:N and A:N since no write or denial-of-service capability is described.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.
Articles & Coverage 2
AnalysisAI
Path traversal in Jenkins Allure Plugin 2.35.2 and earlier allows any user holding Item/Read permission on a Jenkins job that publishes Allure test reports to read arbitrary files from the Jenkins controller's filesystem, including credentials, configuration files, and secrets stored on the controller. The vulnerability is reachable over the network with only low-level authenticated access - a standard privilege held by most Jenkins users in typical multi-user deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Jenkins account with Item/Read permission on at least one job that is configured to publish Allure test report results - this is a non-default configuration requiring the Allure Plugin to be installed and actively used in a job. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8, but the integrity (I:H) and availability (A:H) components are not independently supported by the description, which exclusively describes arbitrary file read - a confidentiality-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Jenkins Allure Plugin to the version released in the 2026-09-02 Jenkins security advisory, as confirmed at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3645. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Jenkins instances running Allure Plugin 2.35.2 or earlier and disable the plugin immediately; rotate all Jenkins system credentials, API tokens, and stored secrets. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today