CVE-2026-92131

The Pipeline: Groovy Libraries Plugin for Jenkins fails to restrict the library path passed to the `library` Pipeline step to a relative path within the SCM checkout, and it follows symbolic links that point outside the checkout, creating a path traversal flaw (CWE-22). An attacker who can configure Pipelines on the Jenkins instance — i.e., an authenticated user with job/pipeline configuration rights — can exploit this via the network. Successful exploitation allows reading files in the resources directory and deleting files in the test directory of the Jenkins controller's file system, partially compromising confidentiality and integrity of the controller. All Jenkins installations running Pipeline: Groovy Libraries Plugin version 805.va_fc79344957d or earlier are affected. No public proof-of-concept is known and the flaw is not listed in CISA KEV; it appears to have been disclosed and patched as part of a recent batch of Jenkins plugin fixes.

What to do: Upgrade the Pipeline: Groovy Libraries Plugin to the fixed release published in the Jenkins security advisory (any version later than 805.va_fc79344957d), which was issued alongside a batch of roughly 20 plugin fixes. Until upgraded, restrict which users can create or configure Pipelines, since exploitation requires job/pipeline configuration privileges. Review controller file systems for unexpected deletions in test directories and audit recently modified resources directories for signs of abuse.