CVE-2026-48921
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The Groovy Libraries Plugin in Jenkins Pipeline version 797.v90ea_a_9b_e45a_0 and earlier does not prohibit the use of symbolic links in shared libraries. This allows attackers who can control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
Risk Assessment
Attackers may gain access to sensitive data on the Jenkins server, potentially leading to serious security breaches and loss of information confidentiality.
Recommendation
It is recommended to update the Groovy Libraries Plugin to the latest version that prohibits the use of symbolic links in shared libraries to minimize the risk of unauthorized file access.
Other vulnerabilities in Jenkins Pipeline: Groovy Libraries Plugin
See all- CVE-2026-92131Medium
Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system.
- CVE-2026-84663Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.
Original NVD description (English source)
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS