# CVE-2026-92131: Jenkins Pipeline: Groovy Libraries Plugin path traversal

Source: https://junglewise.ai/threats/cve-2026-92131-jenkins-pipeline-groovy-libraries-plugin-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92131 · Severity: medium · CVSS 4.2 · Published 2026-09-16

Jenkins Pipeline: Groovy Libraries Plugin is an extension that allows pipelines to load shared Groovy code libraries. A path traversal vulnerability in versions 805.va_fc79344957d and earlier allows pipeline administrators to read arbitrary files from the Jenkins controller's resources directory and delete files from the test directory on the controller file system, potentially exposing sensitive configuration or disrupting Jenkins operations.

Technologies: [Jenkins Pipeline: Groovy Libraries Plugin](https://junglewise.ai/threats/technologies/pipeline-groovy-libraries-plugin). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins).

## Quick answers

**Is CVE-2026-92131 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92131 being exploited in the wild.

**How severe is CVE-2026-92131?** Medium severity, with a CVSS score of 4.2, published 16 September 2026.

**Which products and versions are affected?** Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier.

**Is there a fix for CVE-2026-92131?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92131 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92131?** Check whether you run Jenkins Pipeline: Groovy Libraries Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in the library path handling of the Pipeline: Groovy Libraries Plugin. The plugin fails to restrict library paths to relative paths within the SCM checkout directory and follows symbolic links to locations outside the checkout, enabling attackers with pipeline configuration permissions to traverse the file system. An attacker can exploit this by specifying a malicious library path (e.g., containing ".." sequences or symbolic links) to read files from a resources directory or delete files from a test directory on the Jenkins controller. No special authentication beyond pipeline configuration permissions is required. The fix is available in patched versions of the plugin.

## Affected products

- Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier

## Timeline

- 2026-09-16: disclosed: Vulnerability disclosed in Jenkins Security Advisory

## References

- [https://www.jenkins.io/security/advisory/2026-09-16/](https://www.jenkins.io/security/advisory/2026-09-16/)

## Related threats

- [Jenkins Pipeline: Groovy Libraries Plugin CSRF shared library cache deletion](https://junglewise.ai/threats/cve-2026-84663-jenkins-pipeline-groovy-libraries-plugin-csrf-shared-library)
- [Jenkins Pipeline: Groovy Libraries Plugin arbitrary file read via symbolic links](https://junglewise.ai/threats/cve-2026-48921-jenkins-pipeline-groovy-libraries-plugin-arbitrary-file-read-via)