Live › vulnerability › CVE-2026-117617
Go to dashboardJenkins checks for symbolic links in an extracted file's path only before creating parent directories, not right before writing. An attacker with Item/Configure permission can use symlinks in artifacts to write files to arbitrary locations on the Jenkins controller file system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers at or below 2.587 (weekly) or 2.580.1 (LTS) are affected when users hold Item/Configure permission, since those users can create artifacts with symlinks that get extracted onto the controller. Instances where only trusted administrators can configure jobs carry much less risk. unknown whether the sources describe any default configuration that changes exposure.
No product ranges from the sources yet.
java -jar jenkins.war --version or check the version under Manage Jenkins to see whether the controller is 2.587 or earlier, or LTS 2.580.1 or earlier2.5872.580.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.
This page as .md · .json · in your agent: get_signal("CVE-2026-117617")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.