Jenkins Credentials Binding Plugin
Monthly
Arbitrary file write in the Jenkins Credentials Binding Plugin (version 719.v80e905ef14eb_ and earlier) allows an authenticated user who can supply file or zip file credentials to a job to escape the intended credentials directory via unsanitized file names (path traversal), planting files anywhere on the node filesystem. When Jenkins is configured to let a low-privileged user configure such credentials for a job running on the built-in node, this file write escalates to remote code execution. There is no public exploit identified at time of analysis, and EPSS is low (0.34%, 57th percentile), consistent with the high attack complexity and non-default preconditions.
Arbitrary file write in the Jenkins Credentials Binding Plugin (version 719.v80e905ef14eb_ and earlier) allows an authenticated user who can supply file or zip file credentials to a job to escape the intended credentials directory via unsanitized file names (path traversal), planting files anywhere on the node filesystem. When Jenkins is configured to let a low-privileged user configure such credentials for a job running on the built-in node, this file write escalates to remote code execution. There is no public exploit identified at time of analysis, and EPSS is low (0.34%, 57th percentile), consistent with the high attack complexity and non-default preconditions.