Executive brief
The Jenkins File Parameter Plugin allows attackers to write arbitrary files to the Jenkins controller server through unsafe data binding in the Stapler web framework. By uploading malicious files to sensitive locations on the server, an attacker can achieve remote code execution and take complete control of the Jenkins build automation platform, potentially compromising all projects and credentials stored within.
Technical details
The vulnerability exists in Jenkins File Parameter Plugin version 425.v3fa_801681b_5e and earlier, where Stapler's form data binding fails to restrict instantiation of configuration object types during file parameter processing. An attacker with network access can craft HTTP requests that leverage this type restriction bypass to write files to arbitrary locations on the Jenkins controller filesystem via deserialization. The root cause is insufficient validation of deserialized object types combined with overly permissive Stapler data binding. By writing to sensitive directories (e.g., plugin directories or initialization scripts), an attacker can achieve remote code execution without requiring authentication. A patch restricting object instantiation to compatible field types is required to remediate this issue.
Affected products
- Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: advisory: Jenkins Security Advisory 2026-09-02