Jenkins Core EUVD-2026-112182

Requires an authenticated (non-anonymous) principal with Item/Configure permission who can define and run a Pipeline that archives artifacts. The concrete trigger stated by the vendor is archiving artifacts concurrently (e.g., from parallel Pipeline branches) so that a symbolic link in an artifact replaces an existing file or empty directory in the window between the symlink check (done only before creating parent directories) and the actual file write. Limiting factors: exploitation is confined to Jenkins controllers running 2.587/LTS 2.580.1 and earlier, needs the Item/Configure privilege rather than anonymous access, and depends on winning a TOCTOU race via concurrency, which reduces reliability; the vendor states no partial mitigation and that upgrading to 2.588/LTS 2.580.2 is the fix.

No CVSS vector, EPSS score, KEV entry, or public exploit is present in the supplied data; the vuln.today Decision label is 'awaiting_data' and Jenkins self-rated this issue 'High' without publishing a vector (CVSS Vector: N/A in the linked advisory). Risk must therefore be reasoned from the description alone. The flaw is a time-of-check/time-of-use (TOCTOU) symlink race: Jenkins checks for symbolic links before creating parent directories but not immediately before writing the file, and the description explicitly states exploitation is achieved 'by archiving artifacts concurrently, e.g., from parallel branches of a Pipeline' - so a race window is required, which lowers reliability and makes automated mass exploitation unlikely. Exploitation also requires Item/Configure permission, i.e. an authenticated user who can define/configure jobs, not an anonymous remote attacker. Net: this is a genuine controller-compromise (arbitrary file write → RCE) issue that matters most for Jenkins instances with many semi-trusted job authors, but the authentication requirement and race-condition dependency temper the real-world urgency relative to the 'High' label. Missing data to note explicitly: no CVSS vector is provided so severity cannot be independently reconciled, and EPSS/KEV/POC signals are all absent (absence is not evidence of low interest, only of unavailable telemetry).

An authenticated user holding Item/Configure permission defines a Pipeline that archives artifacts from parallel branches, including an artifact that is a symbolic link pointing outside the artifact target directory. By archiving concurrently the attacker races the symlink check against the file write, causing Jenkins to follow the link and write attacker-controlled content to an arbitrary path on the controller (e.g., a Groovy init script location), leading to remote code execution in the controller JVM. No public exploit identified at time of analysis; success depends on winning the TOCTOU race.