# CVE-2024-23897: Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

Source: https://junglewise.ai/threats/cve-2024-23897-jenkins-command-line-interface-cli-path-traversal-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-24. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2024-23897 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2024-01-24

The Jenkins Command Line Interface (CLI) fails to disable a feature in its command parser that replaces an '@' character followed by a file path with the file's contents. This path traversal vulnerability allows unauthenticated attackers to read arbitrary files on the Jenkins controller file system, potentially leading to remote code execution.

Technologies: [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2024-23897 exploited in the wild?** Yes. CVE-2024-23897 is known to be exploited in the wild, first recorded on 19 August 2024. Treat it as urgent.

**How severe is CVE-2024-23897?** Critical severity, with a CVSS score of 3.1, published 24 January 2024.

**Which products and versions are affected?** org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=1.606,fixed=2.426.3.

**Is there a fix for CVE-2024-23897?** Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.426.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-23897 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-23897?** Check whether you run Jenkins Command Line Interface (CLI) or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.426.3 or later

  ```sh
  # set org.jenkins-ci.main:jenkins-core to 2.426.3 in your pom.xml or build.gradle
  ```


## Affected products

- Jenkins Project Jenkins up to 2.441
- Jenkins Project Jenkins LTS up to 2.426.2

## Identifiers

- CVE-2024-23897
- GHSA-6f9g-cxwr-q5jr

## Timeline

- 2024-01-24: disclosed: Vendor advisory SECURITY-3314 published.
- 2024-08-19: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
- 2024-08-19: other: Vulnerability published to NVD.

## Related threats

- [Jenkins plaintext secret storage in job config.xml submissions](https://junglewise.ai/threats/cve-2026-53442-jenkins-plaintext-secret-storage-in-job-config-xml-submissions)
- [Jenkins stored XSS in node offline cause description](https://junglewise.ai/threats/cve-2026-53441-jenkins-stored-xss-in-node-offline-cause-description)
- [Jenkins open redirect in Delegate to servlet container security realm](https://junglewise.ai/threats/cve-2026-53440-jenkins-open-redirect-in-delegate-to-servlet-container-security)
- [Jenkins missing permission checks in user profile endpoints](https://junglewise.ai/threats/cve-2026-53439-jenkins-missing-permission-checks-in-user-profile-endpoints)
- [Jenkins missing permission check in queue item cancellation](https://junglewise.ai/threats/cve-2026-53438-jenkins-missing-permission-check-in-queue-item-cancellation)