Executive brief
The Jenkins Credentials Binding Plugin, which manages how secrets are handled during automated builds, contains a security flaw in how it processes file names. An attacker with low-level access could exploit this to write malicious files to sensitive locations on the server's filesystem. In certain configurations, this can allow the attacker to take full control of the Jenkins server and execute unauthorized commands.
Technical details
A path traversal vulnerability (CWE-22) exists in the Jenkins Credentials Binding Plugin due to improper sanitization of file names for 'file' and 'zip file' credentials. An attacker with permission to provide credentials to a job can supply a crafted filename containing traversal sequences (e.g., ../) to write files to arbitrary locations on the node's filesystem. If the Jenkins environment allows low-privileged users to configure these credentials for jobs running on the built-in node, this primitive can be escalated to Remote Code Execution (RCE). This issue is an incomplete fix for a previous vulnerability (SECURITY-3672) and is resolved in version 725.ve52b_2328a_fde.
Affected products
- Jenkins Credentials Binding Plugin <= 720.v3f6decef43ea_
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-07-01: patched