Skip to content
fr Sign in
8.8 High

CVE-2026-33001 Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar…

Description

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

Affected products and versions

Product Affected versions Fixed in
OpenShift Developer Tools and Services 4.12 1776764096 earliest → < 1776764096 1776764096
OpenShift Developer Tools and Services 4.13 1776764096 earliest → < 1776764096 1776764096
OpenShift Developer Tools and Services 4.14 1776762347 earliest → < 1776762347 1776762347
OpenShift Developer Tools and Services 4.15 1776762347 earliest → < 1776762347 1776762347
OpenShift Developer Tools and Services 4.16 1776944215 earliest → < 1776944215 1776944215
OpenShift Developer Tools and Services 4.17 1776944215 earliest → < 1776944215 1776944215
OpenShift Developer Tools and Services 4.18 1776944215 earliest → < 1776944215 1776944215
OpenShift Developer Tools and Services 4.19 1776944215 earliest → < 1776944215 1776944215
OpenShift Developer Tools and Services 4.21 1776944215 earliest → < 1776944215 1776944215
Show the 5 other branches
Product Affected versions Fixed in
OpenShift Developer Tools and Services 4.2 1776944215 earliest → < 1776944215 1776944215
Red Hat Developer Hub Versions not published
Jenkins 2.555 earliest → < 2.555 2.555
Jenkins 2.541 earliest → < 2.541.3 2.541.3
OpenShift Developer Tools and Services 4.20 1776944215 earliest → < 1776944215 1776944215

References

Timeline

  1. Published
  2. Last modified

Other CVEs of OpenShift Developer Tools and Services 4.12

The 12 CVEs of OpenShift Developer Tools and Services 4.12 →
CVE-2026-57281 Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations… 7.5 High CVE-2026-53437 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately… 4.3 Medium CVE-2026-53435 In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize… 8.8 High CVE-2026-40542 Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept… Not rated
Track this CVE