Executive brief
Jenkins Robot Framework Plugin allows administrators to configure where test report files are archived. Attackers with configuration permissions can specify paths outside the build directory, enabling them to create or overwrite arbitrary files on the Jenkins server with malicious content, potentially leading to complete system compromise through code execution.
Technical details
The Robot Framework Plugin fails to validate that the configured archive directory for test reports is contained within the Jenkins build directory, enabling a path traversal vulnerability. Attackers with Item/Configure permission can specify an arbitrary directory path via the plugin configuration, bypassing directory containment checks. This allows creation or replacement of arbitrary files on the Jenkins controller file system with attacker-controlled content. By targeting configuration or script files, an attacker can achieve remote code execution in the Jenkins controller process. The vulnerability affects version 6.2.2 and earlier; a patched version should enforce that the archive directory is constrained to the build workspace.
Affected products
- Jenkins Robot Framework Plugin 6.2.2 and earlier
Timeline
- 2026-09-16: disclosed