EUVD-2026-70143
GHSA-ch57-mp3q-j35f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege Jenkins account
-
DeliveryIdentify or configure a job using File Parameter Plugin
-
ExploitSubmit build with path-traversal file parameter
-
ExecutionStapler binding writes payload to arbitrary controller filesystem path
-
PersistOverwrite Groovy init script or SSH authorized_keys
-
ImpactAchieve code execution as Jenkins service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid Jenkins account with at minimum the permissions necessary to trigger a parameterized build (typically Job/Build or Job/Read plus Build). The targeted job must use the File Parameter Plugin's file-type parameter; the plugin must be installed on the controller and actively configured in at least one job. No special network positioning is needed (AV:N - standard HTTPS access to the Jenkins web UI is sufficient). Fully unauthenticated attackers are excluded; the attack is bounded by the Jenkins user directory. Jenkins instances with self-registration enabled, guest/anonymous build trigger permissions, or a large pool of internal users materially expand the effective attack surface beyond the PR:L baseline. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly reflects network-reachable exploitation by any authenticated user with no complexity barrier and no user interaction. The PR:L requirement is the sole gatekeeping factor - any Jenkins account with enough permission to trigger a parameterized build is a potential threat actor. SSVC signals Automatable: no, suggesting that while the exploit mechanism is straightforward, crafting a working traversal to a meaningful target path requires some reconnaissance of the controller filesystem layout. Technical Impact is rated total, consistent with the achievable RCE. SSVC Exploitation: none and the absence of a KEV listing or public POC indicate this is not currently being actively weaponized, making it a high-priority patch target rather than an emergency response item. Jenkins instances with self-registration enabled or large internal user populations face meaningfully elevated risk given the low bar for the required credential. |
| Exploit ScenarioDerived | An attacker with a standard Jenkins user account (e.g., a developer with Job/Build permissions) submits a parameterized build request for a job that uses the File Parameter Plugin, supplying a crafted file parameter whose destination path contains traversal sequences such as '../../init.groovy.d/evil.groovy'. The Stapler binding writes the attacker's uploaded Groovy payload to the Jenkins controller's init scripts directory. Upon the next Jenkins restart or immediate execution of init scripts, the Groovy payload runs under the Jenkins service account, granting the attacker full controller-level code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Arbitrary file write to remote code execution in Jenkins File Parameter Plugin (versions ≤ 425.v3fa_801681b_5e) is achievable by any low-privilege authenticated Jenkins user through a Stapler data binding flaw. By crafting a build request with a path-traversal file parameter, an attacker can write attacker-controlled content to arbitrary locations on the Jenkins controller filesystem, enabling code execution by overwriting Groovy init scripts, SSH authorized_keys, or other sensitive files. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none - but the technical impact ceiling is total controller compromise.
RemediationAI
Upgrade the Jenkins File Parameter Plugin to the version identified as patching SECURITY-4093 in the official advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4093. Note that the exact patched version number is not stated in the available input data and must be confirmed from the advisory before deploying. As an immediate workaround if upgrade is not possible, restrict Job/Configure and Build permissions exclusively to fully trusted users, since the vulnerability requires at minimum a low-privilege authenticated account to trigger. If file-type build parameters are not actively in use, disabling or uninstalling the File Parameter Plugin entirely eliminates the attack surface with no impact on jobs that do not use it; jobs that do rely on it will fail until the plugin is reinstated or upgraded.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Stapler is the web framework Jenkins uses to bind HTTP request parameters directly to Java object properties during request handling. The File Parameter Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_file_parameter_plugin:*:*:*:*:*:*:*:*) supports file-typed build parameters that allow users to upload files consumed during a build. The CWE-22 path traversal root cause means the plugin fails to sanitize the destination path during Stapler binding, allowing a caller to specify '../../' sequences that escape the intended workspace directory. Because the Jenkins controller process typically runs with service-level OS privileges and hosts Groovy scripts, credential stores, and SSH keys, an arbitrary write at that privilege level translates directly to code execution opportunities.
Know when Jenkins File Parameter Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible via HTTP with no complexity barrier; PR:L reflects mandatory low-privilege auth; full C/I/A impact from arbitrary file write enabling RCE on controller.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.
Articles & Coverage 2
Executive ViewAI
Jenkins File Parameter Plugin versions 425.v3fa_801681b_5e and earlier contain a flaw allowing authenticated Jenkins users to execute arbitrary code on the Jenkins controller, potentially compromising CI/CD pipeline integrity and all downstream systems managed through Jenkins. Organizations using this plugin face risks of build tampering, unauthorized deployments, and lateral movement to production infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Restrict build-parameter editing to administrators only via Jenkins role-based access control; (2) whitelist permissible file paths and reject parameters containing path-traversal sequences (../ or absolute paths); (3) disable the File Parameter Plugin if an alternative parameter mechanism exists; (4) deploy Jenkins controllers in restricted containers without write access outside designated /var/jenkins_home subdirectories; (5) monitor Jenkins logs for suspicious build requests and parameter submissions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB