EUVD-2026-80761
GHSA-fj9v-46f5-wpgm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Web-reachable (AV:N) with easy traversal (AC:L); requires Item/Configure so PR:L not PR:N; arbitrary controller file write leading to RCE justifies C:H/I:H/A:H, S:U per Jenkins controller convention.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content, which can lead to remote code execution.
Articles & Coverage 1
AnalysisAI
Path traversal in the Jenkins Robot Framework Plugin (6.2.2 and earlier) allows an authenticated user holding Item/Configure permission to point the plugin's report archive directory at a location outside the build directory, giving attacker-chosen file creation or overwrite anywhere on the Jenkins controller filesystem - an impact that can be escalated to remote code execution. The flaw is remotely reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and requires no user interaction, but it is gated by the Item/Configure privilege, plugin installation and use, and a build actually executing to trigger the write. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Jenkins user with Item/Configure permission on the target instance; the attacker must be able to configure a job that uses the Robot Framework plugin's report archiving and set the archive directory to a path escaping the build directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) describes an authenticated (PR:L) network-reachable path traversal that escalates to arbitrary file write and ultimately RCE on the Jenkins controller - a genuinely high-impact outcome. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: the fix ships through the Jenkins security advisory for 2026-09-16 (SECURITY-3971, https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3971), which covers the Robot Framework Plugin 6.2.2 and earlier; the exact released fix version is not stated in the supplied data and should be confirmed on the advisory page from the Jenkins Update Center before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Jenkins controller and determine whether the Robot Framework Plugin 6.2.2 or earlier is installed (Manage Jenkins > Plugins); if it is installed, immediately remove Item/Configure from all non-administrative users and groups via the authorization strategy configuration, and if the plugin is not actively required for builds, disable or uninstall it outright. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today