# CVE-2026-33001: Jenkins arbitrary file write via symbolic link extraction in archives

Source: https://junglewise.ai/threats/cve-2026-33001-jenkins-arbitrary-file-write-via-symbolic-link-extraction-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-18. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33001 · Severity: high · CVSS 8.8 · Published 2026-03-18

Jenkins, a popular automation server used for software development, contains a vulnerability in how it handles compressed archive files. An attacker with basic configuration permissions can upload a specially crafted archive that places malicious files outside of the intended directory. This could allow an attacker to take control of the Jenkins server, potentially leading to the theft of source code, credentials, or the disruption of software delivery pipelines.

Technologies: [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core), [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-33001 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33001 being exploited in the wild.

**How severe is CVE-2026-33001?** High severity, with a CVSS score of 8.8, published 18 March 2026.

**Which products and versions are affected?** org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=0,fixed=2.555; Red Hat Developer Hub 1; Red Hat OpenShift Developer Tools and Services 4.2, 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, 4.18, 4.19, 4.20, 4.21.

**Is there a fix for CVE-2026-33001?** Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33001 attacked?** It is attacked over the network or with local access, in a hosted service.

**Am I affected by CVE-2026-33001?** Check whether you run org.jenkins-ci.main:jenkins-core (Maven), Red Hat Developer Hub or Red Hat OpenShift Developer Tools and Services at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555 or later

  ```sh
  # set org.jenkins-ci.main:jenkins-core to 2.555 in your pom.xml or build.gradle
  ```


## Technical details

A path traversal vulnerability exists in Jenkins core due to improper link resolution (CWE-59) during the extraction of .tar and .tar.gz archives. The application fails to validate that the target of a symbolic link within an archive remains within the intended extraction directory. An attacker with 'Item/Configure' permissions or control over a Jenkins agent can provide a crafted archive to write arbitrary files to any location accessible by the Jenkins process user. This can be leveraged for Remote Code Execution (RCE) by writing malicious scripts to the 'init.groovy.d' directory or deploying unauthorized plugins. The vulnerability is fixed in Jenkins 2.555 and LTS 2.541.3.

## Affected products

- Jenkins Project Jenkins <= 2.554, LTS <= 2.541.2
- Red Hat OpenShift Developer Tools and Services 4.2, 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, 4.18, 4.19, 4.20, 4.21
- Red Hat Red Hat Developer Hub 1

## Identifiers

- CVE-2026-33001
- GHSA-r6qv-frpc-q66c

## Timeline

- 2026-03-18: disclosed: Initial advisory by Jenkins Project
- 2026-03-18: patched: Jenkins 2.555 and LTS 2.541.3 released
- 2026-04-23: patched: Red Hat released security updates for OpenShift Jenkins components

## References

- [https://www.jenkins.io/security/advisory/2026-03-18/](https://www.jenkins.io/security/advisory/2026-03-18/)
- [https://access.redhat.com/errata/RHSA-2026:10199](https://access.redhat.com/errata/RHSA-2026:10199)
- [https://access.redhat.com/errata/RHSA-2026:10201](https://access.redhat.com/errata/RHSA-2026:10201)
- [https://access.redhat.com/errata/RHSA-2026:10204](https://access.redhat.com/errata/RHSA-2026:10204)
- [https://access.redhat.com/errata/RHSA-2026:10205](https://access.redhat.com/errata/RHSA-2026:10205)
- [https://access.redhat.com/errata/RHSA-2026:10206](https://access.redhat.com/errata/RHSA-2026:10206)
- [https://access.redhat.com/errata/RHSA-2026:10209](https://access.redhat.com/errata/RHSA-2026:10209)

## Related threats

- [Jenkins plaintext secret storage in job config.xml submissions](https://junglewise.ai/threats/cve-2026-53442-jenkins-plaintext-secret-storage-in-job-config-xml-submissions)
- [Jenkins stored XSS in node offline cause description](https://junglewise.ai/threats/cve-2026-53441-jenkins-stored-xss-in-node-offline-cause-description)
- [Jenkins open redirect in Delegate to servlet container security realm](https://junglewise.ai/threats/cve-2026-53440-jenkins-open-redirect-in-delegate-to-servlet-container-security)
- [Jenkins missing permission checks in user profile endpoints](https://junglewise.ai/threats/cve-2026-53439-jenkins-missing-permission-checks-in-user-profile-endpoints)
- [Jenkins missing permission check in queue item cancellation](https://junglewise.ai/threats/cve-2026-53438-jenkins-missing-permission-check-in-queue-item-cancellation)