# CVE-2026-48922: Jenkins Credentials Binding Plugin path traversal in file credentials

Source: https://junglewise.ai/threats/cve-2026-48922-jenkins-credentials-binding-plugin-path-traversal-in-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-48922 · Severity: high · CVSS 7.5 · Published 2026-05-27

The Jenkins Credentials Binding Plugin, which manages how secrets are handled during automated builds, contains a security flaw in how it processes file names. An attacker with low-level access could exploit this to write malicious files to sensitive locations on the server's filesystem. In certain configurations, this can allow the attacker to take full control of the Jenkins server and execute unauthorized commands.

Technologies: [org.jenkins-ci.plugins:credentials-binding (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-credentials-binding). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-48922 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48922 being exploited in the wild.

**How severe is CVE-2026-48922?** High severity, with a CVSS score of 7.5, published 27 May 2026.

**Which products and versions are affected?** Jenkins Credentials Binding Plugin <= 720.v3f6decef43ea_, 720.v3f6decef43ea_ and earlier; org.jenkins-ci.plugins:credentials-binding (Maven) <= 720.v3f6decef43ea, ECOSYSTEM:introduced=0,fixed=725.ve52b.

**Is there a fix for CVE-2026-48922?** Yes. org.jenkins-ci.plugins:credentials-binding (Maven): upgrade to 725.ve52b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48922 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48922?** Check whether you run Jenkins Credentials Binding Plugin or org.jenkins-ci.plugins:credentials-binding (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:credentials-binding (Maven): upgrade to 725.ve52b or later

  ```sh
  # set org.jenkins-ci.plugins:credentials-binding to 725.ve52b in your pom.xml or build.gradle
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in the Jenkins Credentials Binding Plugin due to improper sanitization of file names for 'file' and 'zip file' credentials. An attacker with permission to provide credentials to a job can supply a crafted filename containing traversal sequences (e.g., ../) to write files to arbitrary locations on the node's filesystem. If the Jenkins environment allows low-privileged users to configure these credentials for jobs running on the built-in node, this primitive can be escalated to Remote Code Execution (RCE). This issue is an incomplete fix for a previous vulnerability (SECURITY-3672) and is resolved in version 725.ve52b_2328a_fde.

## Affected products

- Jenkins Credentials Binding Plugin <= 720.v3f6decef43ea_

## Identifiers

- CVE-2026-48922
- GHSA-fxxf-w25w-mcx2

## Timeline

- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-07-01: patched

## References

- [https://www.jenkins.io/security/advisory/2026-05-27/](https://www.jenkins.io/security/advisory/2026-05-27/)

## Related threats

- [Jenkins Credentials Binding Plugin has a path traversal vulnerability](https://junglewise.ai/threats/cve-2026-42520-jenkins-credentials-binding-plugin-has-a-path-traversal)
- [Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages](https://junglewise.ai/threats/cve-2025-53650-jenkins-credentials-binding-plugin-vulnerability-can-expose)
- [Improper masking of some secrets in Jenkins Credentials Binding Plugin](https://junglewise.ai/threats/cve-2020-2182-improper-masking-of-some-secrets-in-jenkins-credentials-binding)
- [Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps](https://junglewise.ai/threats/cve-2020-2181-secrets-are-not-masked-by-jenkins-credentials-binding-plugin-in)
- [Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format](https://junglewise.ai/threats/cve-2019-1010241-jenkins-credentials-binding-plugin-stores-passwords-in-a)