Path Traversal Vulnerability in Jenkins by CloudBees

CVE-2026-117626

What is CVE-2026-117626?

Jenkins versions prior to 2.588 and LTS versions prior to 2.581.0 are susceptible to a path traversal vulnerability. This flaw allows users with Overall/Read permissions to gain unauthorized access to sensitive information regarding files, including names, sizes, and last modification times of files located in $JENKINS_HOME. Furthermore, users with Item/Workspace permissions can discover job names associated with workspaces on the same agent, which could lead to unauthorized data exposure.

References