---
id: "CVE-2026-117615"
kind: "vulnerability"
aliases: ["CVE-2026-117615"]
title: "Jenkins: item rename follows symlinks, letting users read controller files"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ci-cd", "jenkins", "runtime", "self-hosted"]
not_affected_if: ["only-admins-create-jobs", "patched-version"]
published_at: "2026-10-28T17:18:20+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117615", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: item rename follows symlinks, letting users read controller files

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, follow symbolic links when copying the directory of an item being renamed. An attacker with Item/Create and Item/Configure permission can read arbitrary files on the Jenkins controller file system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `jenkins --version` or check the version shown at the bottom of the Jenkins web UI and compare it to `2.587` (weekly) and `2.580.1` (LTS).
- Check which Jenkins users hold Item/Create and Item/Configure permissions in Manage Jenkins > Security > Matrix.

## Fix

- Upgrade Jenkins weekly to a release newer than `2.587`, or LTS to a release newer than `2.580.1`.
- Until upgraded, restrict Item/Create and Item/Configure permissions to trusted users only.

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117615

## From the sources

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_