Vulnerability Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.
References
FAQ
What is CVE-2026-117615?
CVE-2026-117615 is a documented vulnerability. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read...
How severe is CVE-2026-117615?
CVSS scoring is not yet available for CVE-2026-117615. Check NVD for updates.
Is there a patch for CVE-2026-117615?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.