MEDIUMVulnerability

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.

Properties

severity
MEDIUM
score
4.3
cve_id
CVE-2026-70427
vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
published_at
2026-08-05T18:17:12.353
last_modified
2026-08-31T19:34:59.477

Related Entities (2)

HAS_WEAKNESS (1)

[Weakness]Improper Link Resolution Before File Access ('Link Following')

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-70427 — Ninja Signal Threat Intelligence | Ninja Signal