EUVD-2026-80761
GHSA-fj9v-46f5-wpgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Item/Configure permission
-
DeliveryConfigure Robot Framework archive dir with traversal path
-
ExploitTrigger build to write file outside build dir
-
ExecutionOverwrite controller script/config with payload
-
ImpactAchieve RCE on Jenkins controller
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Jenkins user with Item/Configure permission on the target instance; the attacker must be able to configure a job that uses the Robot Framework plugin's report archiving and set the archive directory to a path escaping the build directory. The plugin (version ≤6.2.2) does not validate that the configured archive directory is contained within the build directory on the controller. Limiting factors: exploitation is gated by the Item/Configure privilege (not anonymous), the plugin must be installed and used in the job, and a build must execute to trigger the file write - so realistic risk is highest in multi-user or multi-tenant controllers where lower-trust users can configure jobs. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) describes an authenticated (PR:L) network-reachable path traversal that escalates to arbitrary file write and ultimately RCE on the Jenkins controller - a genuinely high-impact outcome. However, PR:L is the critical mitigating signal: exploitation requires an account holding Item/Configure permission, so this is not an anonymous internet-facing bug but rather a privilege-escalation/controller-takeover primitive available to users who can already configure jobs. No EPSS score, no CISA KEV listing, and no public POC were provided, so per available data this is 'no public exploit identified at time of analysis' - a patch-priority issue driven by impact rather than by evidence of active exploitation. The signals are internally consistent (network web UI + authenticated config permission + controller file write), so there is no AV/description conflict to flag; the main risk-tempering factor is that any Item/Configure holder in Jenkins is already semi-trusted, making this most relevant to environments with many low-trust job configurers or multi-tenant controllers. |
| Exploit ScenarioDerived | An attacker holding Item/Configure permission on a Jenkins instance configures a Robot Framework post-build/publisher step with an archive directory path that escapes the build directory (e.g. via ../ traversal) to a sensitive location on the controller. When the build runs, the plugin writes attacker-controlled report content outside the build directory, overwriting a Groovy init script, plugin, or config file, which is then executed to achieve remote code execution on the controller. No public exploit code is identified at time of analysis, but the technique is straightforward path traversal. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Path traversal in the Jenkins Robot Framework Plugin (6.2.2 and earlier) allows an authenticated user holding Item/Configure permission to point the plugin's report archive directory at a location outside the build directory, giving attacker-chosen file creation or overwrite anywhere on the Jenkins controller filesystem - an impact that can be escalated to remote code execution. The flaw is remotely reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and requires no user interaction, but it is gated by the Item/Configure privilege, plugin installation and use, and a build actually executing to trigger the write. No public exploit code has been identified at time of analysis, and the risk concentrates on multi-user or multi-tenant controllers where lower-trust users are permitted to configure jobs.
RemediationAI
Patch available per vendor advisory: the fix ships through the Jenkins security advisory for 2026-09-16 (SECURITY-3971, https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3971), which covers the Robot Framework Plugin 6.2.2 and earlier; the exact released fix version is not stated in the supplied data and should be confirmed on the advisory page from the Jenkins Update Center before upgrading. In the interim, the most effective compensating control is to remove Item/Configure permission from untrusted accounts (for example via Matrix Authorization Strategy, or by restricting who can create/configure jobs), accepting the trade-off that legitimate developers will lose the ability to edit job definitions. Also review existing job configurations for Robot Framework report archive directories that resolve outside the build workspace and correct them, install the latest plugin release as soon as the advisory lists it, and uninstall or disable the Robot Framework Plugin entirely on controllers that do not need it - the trade-off being loss of Robot Framework report publishing. Because exploitation requires a build to execute before the file write occurs, restricting build execution to trusted principals and auditing writes to controller-level executable paths provide additional detection-oriented coverage; note that none of these workarounds fully eliminate the traversal primitive while the vulnerable plugin version remains installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the plugin takes the archive directory configured for Robot Framework report files and uses it to place output on the Jenkins controller without verifying that the resulting path stays inside the build directory. Because Jenkins build workspaces are the intended, sandboxed destination for build artefacts, the missing containment check means a crafted directory value - for example one containing parent-directory sequences or an absolute path - escapes the workspace and lands in an arbitrary location on the controller's filesystem. Path traversal of this kind in a Jenkins plugin is dangerous because the controller filesystem host process runs with the controller's privileges and Jenkins loads executable content from well-known locations, so a successful arbitrary write can be chained into remote code execution. The CPE entry cpe:2.3:a:jenkins_project:jenkins_robot_framework_plugin:*:*:*:*:*:*:*:* and the EUVD affected-version range (Jenkins Robot Framework Plugin 0 through 6.2.2) both indicate the whole plugin line up to and including 6.2.2 is affected. Per the vector's PR:L and UI:N, exploitation is authenticated but needs no victim interaction, and the scope is unchanged, meaning the compromise is confined to the Jenkins controller context the plugin already runs in.
Know when Jenkins Robot Framework Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Web-reachable (AV:N) with easy traversal (AC:L); requires Item/Configure so PR:L not PR:N; arbitrary controller file write leading to RCE justifies C:H/I:H/A:H, S:U per Jenkins controller convention.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content, which can lead to remote code execution.
Articles & Coverage 2
Executive ViewAI
The Jenkins Robot Framework Plugin (version 6.2.2 and earlier) contains a path traversal flaw that allows an authenticated user with Item/Configure permission to write attacker-chosen files anywhere on the Jenkins controller filesystem, a capability that can be escalated to remote code execution on the build server. No vendor-released patch has been identified at time of analysis, so any multi-user or multi-tenant Jenkins controller where developers, contractors, or other lower-trust users can configure jobs is exposed, with potential consequences including arbitrary code execution, theft of CI/CD credentials and secrets, and lateral movement into connected source control and deployment systems.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or uninstall the Robot Framework Plugin where it is not required; restrict the Item/Configure permission (and job configuration generally) to trusted administrators only via matrix-based security or the Role-based Authorization Strategy plugin; segregate Jenkins controllers by trust boundary so lower-trust users do not share a controller with sensitive pipelines; deploy file integrity monitoring on JENKINS_HOME to detect out-of-tree file writes; enable Jenkins audit trail logging and review plugin report archive paths; back up the Jenkins controller; and limit network exposure of the controller to trusted administrative networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB