{"id":"CVE-2026-117617","kind":"vulnerability","aliases":["CVE-2026-117617"],"related":[],"title":"Jenkins: symlink check race lets users write files anywhere on controller","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.","summary":"Jenkins checks for symbolic links in an extracted file's path only before creating parent directories, not right before writing. An attacker with Item/Configure permission can use symlinks in artifacts to write files to arbitrary locations on the Jenkins controller file system.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","runtime","self-hosted"],"not_affected_if":["no-untrusted-job-authors"],"how_to_check":"- Run `java -jar jenkins.war --version` or check the version under Manage Jenkins to see whether the controller is `2.587` or earlier, or LTS `2.580.1` or earlier\n- unknown whether the sources list a plugin or setting that narrows exposure","fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- unknown whether the sources name a specific fixed version","status":"open","published_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:56+00:00","updated_at":"2026-10-28T17:34:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T17:34:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- unknown whether the sources name a specific fixed version","reach":"network","title":"Jenkins: symlink check race lets users write files anywhere on controller","impact":"high","summary":"Jenkins checks for symbolic links in an extracted file's path only before creating parent directories, not right before writing. An attacker with Item/Configure permission can use symlinks in artifacts to write files to arbitrary locations on the Jenkins controller file system.","category":"runtime","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker writes arbitrary files on the Jenkins controller file system","analyst_note":"Check the Jenkins security advisory for the fixed versions and any plugin or setting that limits the artifact extraction path; the NVD entry alone does not give fixed versions.","how_to_check":"- Run `java -jar jenkins.war --version` or check the version under Manage Jenkins to see whether the controller is `2.587` or earlier, or LTS `2.580.1` or earlier\n- unknown whether the sources list a plugin or setting that narrows exposure","needs_analyst":true,"not_affected_if":["no-untrusted-job-authors"],"who_is_affected":"Jenkins controllers at or below 2.587 (weekly) or 2.580.1 (LTS) are affected when users hold Item/Configure permission, since those users can create artifacts with symlinks that get extracted onto the controller. Instances where only trusted administrators can configure jobs carry much less risk. unknown whether the sources describe any default configuration that changes exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":3348,"output_tokens":653,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117617':14A,17A '-2026':13A,16A '2.580.1':73C '2.587':69C 'allow':99C,111C 'anywher':9A 'arbitrari':60B,120C 'artifact':55B,103C 'attack':47B,112C 'cd':20B 'check':3A,27B,76C 'ci':19B 'ci-cd':18B 'control':11A,65B,125C 'creat':39B,89C 'cve':12A,15A 'directori':41B,92C,110C 'earlier':71C,75C 'empti':109C 'exist':106C 'extract':33B,85C 'file':8A,34B,58B,66B,86C,107C,118C,126C 'host':25B 'immedi':94C 'item/configure':49B,114C 'jenkin':1A,21B,26B,64B,68C,124C 'let':5A 'link':30B,79C,101C 'locat':61B,121C 'lts':72C 'parent':40B,91C 'path':36B,82C 'permiss':50B,115C 'race':4A 'replac':105C 'right':43B 'runtim':22B 'self':24B 'self-host':23B 'symbol':29B,78C,100C 'symlink':2A,53B 'system':67B,127C 'use':52B 'user':6A 'write':7A,45B,57B,96C,117C","nicknames":[],"mitigations":[],"who_affected":"Jenkins controllers at or below 2.587 (weekly) or 2.580.1 (LTS) are affected when users hold Item/Configure permission, since those users can create artifacts with symlinks that get extracted onto the controller. Instances where only trusted administrators can configure jobs carry much less risk. unknown whether the sources describe any default configuration that changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117617","severity":null,"published_at":"2026-10-28T17:18:21+00:00","modified_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}