CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows the plugin's backup configuration to be overwritten through Stapler data binding, so an attacker with limited (low-privilege, authenticated) access can submit crafted binding values that change where backups are written. Because of the resulting path traversal (CWE-22), the attacker can redirect backup writes to an attacker-specified directory and cause arbitrary files from the Jenkins controller file system to be included in those backups, gaining high-confidence read access to sensitive controller files (potentially including stored credentials) plus limited ability to redirect writes (CVSS 3.1: 7.1, C:H/I:L/A:N, no user interaction required). Any Jenkins controller with ThinBackup 2.1.4 or earlier installed is affected. There is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and no in-the-wild exploitation has been reported, with EPSS currently estimating only a ~0.3% probability of exploitation within 30 days.

What to do: Update the ThinBackup plugin to the latest release available from the Jenkins update center (any version newer than 2.1.4) on every Jenkins controller. Until patched, restrict low-privilege users' access to the plugin's configuration endpoints on shared controllers, and check for unexpected backup archives or recent changes to the ThinBackup configuration that could indicate exploitation.