Skip to content
fr Sign in
9.8 Critical Exploited · ransomware

CVE-2024-23897 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns Known to be used
Weakness CWE-27

Description

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Affected products and versions

Product Affected versions Fixed in
Jenkins 2.442 earliest → < 2.442 2.442
Jenkins 2.440 earliest → < 2.440.1 2.440.1
Jenkins 2.426 earliest → < 2.426.3 2.426.3
jenkins 2.442 earliest → < 2.442 2.442
jenkins 2.440 earliest → < 2.440.1 2.440.1
jenkins 2.426 earliest → < 2.426.3 2.426.3

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of Jenkins

The 153 CVEs of Jenkins →
CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Medium CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Medium CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 High CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Medium
Track this CVE