Medium severity4.3NVD Advisory· Published Aug 5, 2026· Updated Sep 8, 2026
CVE-2026-70427
CVE-2026-70427
Description
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: 2.575 and earlier, LTS 2.568.1 and earlier
- osv-coords2 versions
< 2.568.2-r0+ 1 more
- (no CPE)range: < 2.568.2-r0
- (no CPE)range: < 2.568.2
Patches
Vulnerability mechanics
References
1- www.jenkins.io/security/advisory/2026-08-05/nvdVendor Advisory
News mentions
1- Jenkins Security Advisory 2026-08-05Jenkins Security Advisories · Aug 5, 2026