CVE-2026-70428

—

CVSS 3.1

4.3 medium

EPSS

<1%p25

Published

Aug 5, 2026 (Aug 5, 2026)

Modified

Sep 8, 2026

Description

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

Vendors: jenkins
Products: jenkins
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.