Unrated severityNVD Advisory· Published Oct 28, 2026
CVE-2026-117626
CVE-2026-117626
Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 2.587 and earlier, LTS 2.580.1 and earlier
Patches
Vulnerability mechanics
References
1News mentions
1- Jenkins Security Advisory 2026-10-28Jenkins Security Advisories · Oct 28, 2026