Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.
This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Mar 2026, 18:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* |
|
| References | () https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657 - Vendor Advisory | |
| First Time |
Jenkins jenkins
Jenkins |
19 Mar 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-59 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
18 Mar 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-18 16:16
Updated : 2026-03-20 18:08
NVD link : CVE-2026-33001
Mitre link : CVE-2026-33001
CVE.ORG link : CVE-2026-33001
JSON object : View
Products Affected
jenkins
- jenkins
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')