Junglewise Threat Intelligence

CVE-2026-33001: Jenkins arbitrary file write via symbolic link extraction in archives

CVE-2026-33001 · Severity: high · CVSS 8.8 · Published 2026-03-18

Technologies: org.jenkins-ci.main:jenkins-core (Maven), Red Hat Developer Hub. Vendors: Red Hat, Jenkins Project, Maven.

Executive brief

Jenkins, a popular automation server used for software development, contains a vulnerability in how it handles compressed archive files. An attacker with basic configuration permissions can upload a specially crafted archive that places malicious files outside of the intended directory. This could allow an attacker to take control of the Jenkins server, potentially leading to the theft of source code, credentials, or the disruption of software delivery pipelines.

Technical details

A path traversal vulnerability exists in Jenkins core due to improper link resolution (CWE-59) during the extraction of .tar and .tar.gz archives. The application fails to validate that the target of a symbolic link within an archive remains within the intended extraction directory. An attacker with 'Item/Configure' permissions or control over a Jenkins agent can provide a crafted archive to write arbitrary files to any location accessible by the Jenkins process user. This can be leveraged for Remote Code Execution (RCE) by writing malicious scripts to the 'init.groovy.d' directory or deploying unauthorized plugins. The vulnerability is fixed in Jenkins 2.555 and LTS 2.541.3.

Affected products

  • Jenkins Project Jenkins <= 2.554, LTS <= 2.541.2
  • Red Hat OpenShift Developer Tools and Services 4.2, 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, 4.18, 4.19, 4.20, 4.21
  • Red Hat Red Hat Developer Hub 1

Timeline

  • 2026-03-18: disclosed: Initial advisory by Jenkins Project
  • 2026-03-18: patched: Jenkins 2.555 and LTS 2.541.3 released
  • 2026-04-23: patched: Red Hat released security updates for OpenShift Jenkins components

References

Related threats