Sign in

4.3 Medium

CVE-2026-70428 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file…

Description

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins 2.576	earliest → < 2.576	2.576
Jenkins 2.568	earliest → < 2.568.2	2.568.2

The 153 CVEs of Jenkins →

CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Medium CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Medium CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 High CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Medium

Do you use Jenkins?

Track this CVE Watch Jenkins Check my SBOMs

www.cveye.io/en/cve/CVE-2026-70428

Timeline

Published August 5, 2026
Last modified August 5, 2026

References

Jenkins Security Advisory 2026-08-05 www.jenkins.io

Track this CVE