---
id: "CVE-2026-117626"
kind: "vulnerability"
aliases: ["CVE-2026-117626"]
title: "Jenkins: path traversal check exposes file names and sizes to readers"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ci-cd", "infrastructure", "jenkins", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-28T17:18:21+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117626", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: path traversal check exposes file names and sizes to readers

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, fail to correctly detect path traversal in the file browser for workspaces and the userContent directory. An attacker with Overall/Read permission can list names, sizes and modification times of files in JENKINS_HOME, and one with Item/Workspace permission can learn names of jobs that have workspaces on the same agent.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running version with the Jenkins version shown at the bottom of the web UI or `java -jar jenkins.war --version`
- Compare against the fixed release in the Jenkins security advisory linked from the NVD entry

## Fix

- Upgrade Jenkins core to a release newer than `2.587` (weekly) or newer than `2.580.1` (LTS), per the Jenkins security advisory
- Review which accounts hold Overall/Read and Item/Workspace permissions and remove them where not needed

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117626

## From the sources

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_