CVE-2026-92131
UnknownSummary
Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system.
Risk Assessment
An attacker able to configure Pipelines can read and delete files on the Jenkins controller, potentially leading to data leakage or system damage.
Recommendation
Update Jenkins Pipeline: Groovy Libraries Plugin to a version newer than 805.va_fc79344957d, which restricts the library path to a relative path inside the SCM checkout and does not follow symbolic links.
Other vulnerabilities in Jenkins Pipeline: Groovy Libraries Plugin
See all- CVE-2026-48921High
The Groovy Libraries Plugin in Jenkins Pipeline version 797.v90ea_a_9b_e45a_0 and earlier does not prohibit the use of symbolic links in shared libraries. This allows attackers who can control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
- CVE-2026-84663Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.
Original NVD description (English source)
Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system.