CVE-2026-33001

HIGH

Jenkins has a link following vulnerability allows arbitrary file creation

Published March 18, 2026Updated June 4, 2026Source: osv

Summary

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.jenkins-ci.main:jenkins-core to 2.555 or later

<!-- Update pom.xml dependency version to 2.555 for org.jenkins-ci.main:jenkins-core -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
org.jenkins-ci.main:jenkins-core	maven	1.396, 1.397, 1.398, 1.399 (+1008 more)	2.555

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-59
View on MITRE
CWE-61
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-33001?: Jenkins has a link following vulnerability allows arbitrary file creation This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-33001?: CVE-2026-33001 affects org.jenkins-ci.main:jenkins-core. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33001 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-r6qv-frpc-q66c

BIT-jenkins-2026-33001

Related CVEs

CVE-2017-1000353
CRITICAL
Deserialization of Untrusted Data in Jenkins
CVE-2016-9299
CRITICAL
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
CVE-2024-23897
CRITICAL
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
CVE-2017-1000362
CRITICAL
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
CVE-2018-1000861
CRITICAL
Deserialization of Untrusted Data in Jenkins
CVE-2016-0788
CRITICAL
Jenkins allows Execution of Code by Opening a JRMP Listener
CVE-2026-53435
HIGH
Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
CVE-2024-43044
HIGH
Jenkins Remoting library arbitrary file read vulnerability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies