Unscored severity · published Oct 28, 2026
CVE-2026-117617
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before…
New
–
CVSS
–
EPSS
No
On KEV
Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jenkins · Jenkins
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117617
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117617
www.jenkins.io
https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4248
More from Jenkins
9.9
CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
9.9
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
9.8
CVE-2024-23897
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
9.8
CVE-2018-1000861
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in…
9.8
CVE-2017-1000353
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution