–
Not scored
CVE-2026-117626
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers…
JenkinsAffectedJenkins
FixUpdate to 2.588, 2.580.2 or newer
PublishedOct 28, 16:48 · jenkins
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.
From jenkins
Affected and fixed versions
ProductAffectedFixed inJenkinsNot affected2.588JenkinsNot affected2.580.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known