CVE-2026-117626
Summary
| CVE | CVE-2026-117626 |
|---|---|
| State | PUBLISHED |
| Assigner | jenkins |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-28 17:18:21 UTC |
| Updated | 2026-10-29 15:04:37 UTC |
| Description | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent. |
Risk And Classification
EPSS: 0.001700000 probability, percentile 0.064220000 (date 2026-10-29)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Jenkins Project | Jenkins | unaffected 2.588 * maven | Not specified |
| CNA | Jenkins Project | Jenkins | unaffected 2.580.2 2.580.* maven | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.jenkins.io/security/advisory/2026-10-28 | [email protected] | www.jenkins.io | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.