Executive brief
Jenkins ThinBackup Plugin allows attackers to redirect backup files to arbitrary directories and include sensitive files from the Jenkins server through insecure web request handling. This could enable attackers to steal sensitive Jenkins configuration data or overwrite critical system files with malicious backups.
Technical details
This vulnerability exploits Stapler data binding in Jenkins ThinBackup Plugin 2.1.4 and earlier, where configuration parameters are not properly validated when submitted via HTTP forms. An attacker can craft requests that override the plugin's backup destination directory and file inclusion settings, allowing them to write backups to arbitrary locations on the file system and exfiltrate arbitrary files from the Jenkins controller. The vulnerability requires network access to the Jenkins instance and affects the backup configuration mechanism directly. The fix involves restricting the types of configuration objects that can be instantiated via Stapler form data binding and validating configuration parameters before applying them.
Affected products
- Jenkins ThinBackup Plugin 2.1.4 and earlier
Timeline
- 2026-09-02: disclosed