High severity7.5NVD Advisory· Published May 27, 2026· Updated Jun 17, 2026
CVE-2026-48921
CVE-2026-48921
Description
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.jenkins.plugins:pipeline-groovy-libMaven | < 798.v5cc688825312 | 798.v5cc688825312 |
Affected products
3<=797.v90ea_a_9b_e45a_0+ 1 more
- (no CPE)range: <=797.v90ea_a_9b_e45a_0
- (no CPE)range: <=797.v90ea_a_9b_e45a_0
- cpe:2.3:a:jenkins:pipeline\:_groovy_libraries:*:*:*:*:*:*:*:*Range: <798.v5cc688825312
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-qjq3-wqj5-g37qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-48921ghsaADVISORY
- www.jenkins.io/security/advisory/2026-05-27/nvdVendor AdvisoryWEB
News mentions
2- Jenkins Security Advisory: 13 CVEs Across 11 Plugins Disclosed May 2026Vypr Intelligence · May 27, 2026
- Jenkins Security Advisory 2026-05-27Jenkins Security Advisories · May 27, 2026