---
id: "CVE-2026-117617"
kind: "vulnerability"
aliases: ["CVE-2026-117617"]
title: "Jenkins: symlink check race lets users write files anywhere on controller"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ci-cd", "jenkins", "runtime", "self-hosted"]
not_affected_if: ["no-untrusted-job-authors"]
published_at: "2026-10-28T17:18:21+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117617", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: symlink check race lets users write files anywhere on controller

Jenkins checks for symbolic links in an extracted file's path only before creating parent directories, not right before writing. An attacker with Item/Configure permission can use symlinks in artifacts to write files to arbitrary locations on the Jenkins controller file system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `java -jar jenkins.war --version` or check the version under Manage Jenkins to see whether the controller is `2.587` or earlier, or LTS `2.580.1` or earlier
- unknown whether the sources list a plugin or setting that narrows exposure

## Fix

- Upgrade Jenkins weekly to a release later than `2.587`
- Upgrade Jenkins LTS to a release later than `2.580.1`
- unknown whether the sources name a specific fixed version

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117617

## From the sources

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_