CVE-2026-19429
Received Received - Intake

Path Traversal in Jenkins via Incomplete Tar Archive Patch

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-19429
EUVD
EUVD-2026-55615

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jenkins jenkins 2.555.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incomplete patch for CVE-2026-33001 in Jenkins. It allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem using a crafted tar archive. The patch validates symlink destinations but not targets, so a symlink inside the workspace can point outside it to access sensitive files like secrets/master.key or credentials.xml.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive files on the Jenkins server, including configuration files and secrets. This may lead to unauthorized data exposure, potential system compromise, or further attacks within the environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). Unauthorized file access may result in data breaches, triggering legal penalties and regulatory fines.

Mitigation Strategies

Upgrade Jenkins to a version that includes a complete patch for CVE-2026-33001 or later. Ensure the update validates both symlink destinations and targets during tar extraction to prevent arbitrary file reads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart