Backup Configuration Overwrite in Jenkins ThinBackup Plugin by CloudBees

CVE-2026-84667

What is CVE-2026-84667?

The Jenkins ThinBackup Plugin versions up to 2.1.4 contains a vulnerability that allows attackers to manipulate the plugin's backup configuration settings through Stapler data binding. This flaw enables unauthorized users to reroute backup outputs to a directory of their choice, potentially accessing and including arbitrary files from the Jenkins controller's file system. The exposed attack vector poses a serious risk to data integrity and security for Jenkins installations utilizing this plugin.

References