High severity · published Jun 24, 2026
CVE-2026-57296
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step,…
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jenkins External Workspace Manager Plugin · Jenkins Project
through 1.3.2 · source: vendor
Affected product
JE
Jenkins External Workspace Manager Plugin
Jenkins Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57296
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57296
www.jenkins.io
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3777
More from Jenkins External Workspace Manager Plugin
4.3
CVE-2026-70436
Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing…