CVE-2026-92137

The Robot Framework Plugin for Jenkins, version 6.2.2 and earlier, fails to verify that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller (a path traversal flaw, CWE-22). An attacker who holds Item/Configure permission on any job can set an archive directory pointing outside the build directory and thereby create or replace arbitrary files on the controller file system with attacker-specified content. By overwriting sensitive files, the attacker can achieve remote code execution on the Jenkins controller. Any Jenkins instance running the affected plugin is exposed, particularly where Item/Configure permission is granted to broad or partially trusted user groups. No public proof-of-concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation has not been confirmed.

What to do: Upgrade the Robot Framework Plugin to a fixed release newer than 6.2.2 as soon as it is published, and review Jenkins security advisories for the exact fixed version. Until then, restrict Item/Configure permission to fully trusted users only, and audit existing job configurations for archive directory paths that escape the build directory. Check the Jenkins controller file system for unexpected or recently modified files that could indicate abuse.