CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.

8.1 HIGHEPSS 0.47%Not in KEVNVD: Modified

Last updated: 2026-11-05 20:17 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.1	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Details

CVE ID: CVE-2026-117617
Status: Modified
Assigner (CNA): jenkins
Published: Oct 28, 2026
Last modified: 2026-11-05 20:17 UTC
Weaknesses: CWE-59

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:24 UTC.