Symbolic Link Vulnerability in Jenkins by CloudBees

CVE-2026-117617

What is CVE-2026-117617?

The vulnerability in Jenkins allows attackers with Item/Configure permission to exploit the method of checking symbolic links in file paths. When a file is extracted, the system only verifies symbolic links before the creation of parent directories, not at the point of writing. This oversight permits malicious users to replace existing files or write to arbitrary locations within the Jenkins controller file system by using symbolic links within artifacts.

References