Vulnerability Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.
References
FAQ
What is CVE-2026-117626?
CVE-2026-117626 is a documented vulnerability. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with...
How severe is CVE-2026-117626?
CVSS scoring is not yet available for CVE-2026-117626. Check NVD for updates.
Is there a patch for CVE-2026-117626?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.