Executive brief
Jenkins Pipeline: Groovy Libraries Plugin is an extension that allows pipelines to load shared Groovy code libraries. A path traversal vulnerability in versions 805.va_fc79344957d and earlier allows pipeline administrators to read arbitrary files from the Jenkins controller's resources directory and delete files from the test directory on the controller file system, potentially exposing sensitive configuration or disrupting Jenkins operations.
Technical details
The vulnerability is a path traversal flaw in the library path handling of the Pipeline: Groovy Libraries Plugin. The plugin fails to restrict library paths to relative paths within the SCM checkout directory and follows symbolic links to locations outside the checkout, enabling attackers with pipeline configuration permissions to traverse the file system. An attacker can exploit this by specifying a malicious library path (e.g., containing ".." sequences or symbolic links) to read files from a resources directory or delete files from a test directory on the Jenkins controller. No special authentication beyond pipeline configuration permissions is required. The fix is available in patched versions of the plugin.
Affected products
- Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier
Timeline
- 2026-09-16: disclosed: Vulnerability disclosed in Jenkins Security Advisory