High severity7.5NVD Advisory· Published May 27, 2026· Updated Jun 17, 2026
CVE-2026-48922
CVE-2026-48922
Description
Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:credentials-bindingMaven | < 725.ve52b | 725.ve52b |
Affected products
3<=720.v3f6decef43ea_+ 1 more
- (no CPE)range: <=720.v3f6decef43ea_
- (no CPE)range: <=720.v3f6decef43ea_
- cpe:2.3:a:jenkins:credentials_binding:*:*:*:*:*:jenkins:*:*Range: <725.ve52b_2328a_fde
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-fxxf-w25w-mcx2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-48922ghsaADVISORY
- www.jenkins.io/security/advisory/2026-05-27/nvdVendor AdvisoryWEB
News mentions
2- Jenkins Security Advisory: 13 CVEs Across 11 Plugins Disclosed May 2026Vypr Intelligence · May 27, 2026
- Jenkins Security Advisory 2026-05-27Jenkins Security Advisories · May 27, 2026