CVE-2026-33001 - Vulnerability Analysis

Overview

Jenkins <= 2.554 and LTS <= 2.541.2 contains a path traversal caused by unsafe handling of symbolic links during extraction of .tar and .tar.gz archives, letting attackers with Item/Configure permission or control over agent processes write files arbitrarily on the filesystem.

Severity & Score

Impact

Attackers with specific permissions can write files arbitrarily, potentially deploying malicious scripts or plugins on the Jenkins controller.

Mitigation

Update to a version later than 2.554 or LTS later than 2.541.2.

References

• https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner