CVE-2026-33001 Overview
A symbolic link handling vulnerability exists in Jenkins 2.554 and earlier, as well as LTS 2.541.2 and earlier, that allows arbitrary file writes during the extraction of .tar and .tar.gz archives. The vulnerability occurs because Jenkins does not safely handle symbolic links during archive extraction, enabling attackers to craft malicious archives that write files to arbitrary locations on the filesystem. The attack is restricted only by the file system access permissions of the user running Jenkins.
This vulnerability can be exploited to deploy malicious scripts or plugins on the Jenkins controller by attackers with Item/Configure permission or those able to control agent processes.
Critical Impact
Attackers can achieve arbitrary file write capabilities on the Jenkins controller, potentially leading to remote code execution through malicious script or plugin deployment.
Affected Products
- Jenkins 2.554 and earlier
- Jenkins LTS 2.541.2 and earlier
Discovery Timeline
- 2026-03-18 - CVE CVE-2026-33001 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-33001
Vulnerability Analysis
This vulnerability falls under CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack or link following vulnerability. The flaw exists in how Jenkins processes archive files during extraction operations.
When Jenkins extracts .tar or .tar.gz archives, it fails to properly validate and handle symbolic links embedded within the archive structure. An attacker can craft a malicious archive containing symbolic links that point to locations outside the intended extraction directory. During extraction, files following these symbolic links are written to arbitrary filesystem locations, effectively bypassing directory containment.
The vulnerability requires authenticated access with Item/Configure permission, or the ability to control agent processes. This makes it exploitable by lower-privileged users within a Jenkins environment, significantly expanding the potential attack surface in multi-user Jenkins deployments.
Root Cause
The root cause is insufficient validation of symbolic link targets during archive extraction. Jenkins does not verify that symbolic links within archives resolve to paths within the intended extraction directory before following them. This allows path traversal via symlinks, enabling writes outside the designated extraction location.
The vulnerability is a classic "zip slip" variant affecting tar archives, where the archive extraction routine trusts the path information within the archive without proper sanitization.
Attack Vector
The attack is network-accessible and requires low privileges (authenticated user with Item/Configure permission or agent control). An attacker can exploit this vulnerability by:
- Crafting a malicious .tar or .tar.gz archive containing a symbolic link pointing to a sensitive directory (e.g., the Jenkins plugins directory)
- Including malicious content that will be written through the symlink
- Uploading the archive to Jenkins where it will be extracted (via build steps, artifact handling, or plugin functionality)
- Upon extraction, the malicious files are written to the target location, potentially deploying backdoor scripts or malicious plugins
The exploitation does not require user interaction and can be performed remotely over the network. The symlink attack allows files to be written anywhere the Jenkins user has write permissions, which typically includes critical directories for plugin deployment, script execution, and configuration.
Detection Methods for CVE-2026-33001
Indicators of Compromise
- Unexpected files appearing in Jenkins plugin directories ($JENKINS_HOME/plugins/)
- Suspicious symbolic links in extracted archive content or temporary directories
- Unexplained modifications to Jenkins scripts or configuration files
- Unauthorized plugin installations or modifications
- Unusual archive extraction activities in Jenkins job logs
Detection Strategies
- Monitor file system activities for writes outside expected extraction directories during archive operations
- Implement file integrity monitoring (FIM) on critical Jenkins directories including $JENKINS_HOME/plugins/, $JENKINS_HOME/init.groovy.d/, and configuration directories
- Review Jenkins audit logs for suspicious Item/Configure permission usage
- Scan uploaded archives for symbolic links pointing outside the archive root
- Monitor for unusual archive uploads by users with elevated permissions
Monitoring Recommendations
- Enable detailed logging for archive extraction operations within Jenkins
- Configure alerts for new file creation in Jenkins plugin and script directories
- Implement real-time monitoring for symbolic link creation in temporary and extraction directories
- Audit user activities involving archive uploads and extractions
- Deploy endpoint detection and response (EDR) solutions to monitor Jenkins controller filesystem activities
How to Mitigate CVE-2026-33001
Immediate Actions Required
- Upgrade Jenkins to the latest patched version immediately
- For Jenkins weekly, upgrade to version 2.555 or later
- For Jenkins LTS, upgrade to version 2.541.3 or later
- Review recent archive extraction activities for signs of exploitation
- Audit Item/Configure permission grants and restrict to trusted users only
Patch Information
Jenkins has released security updates to address this vulnerability. The fix implements proper symbolic link handling during archive extraction, preventing writes outside the intended extraction directory.
Refer to the Jenkins Security Advisory #SECURITY-3657 for complete patch details and download links.
Workarounds
- Restrict Item/Configure permission to only highly trusted users until patching is complete
- Implement strict access controls on Jenkins agent processes
- Consider using a dedicated, restricted user account to run Jenkins with minimal filesystem permissions
- Temporarily disable functionality that processes uploaded archives if feasible
- Monitor file system activities closely and implement file integrity monitoring on critical Jenkins directories
# Configuration example - Restrict Jenkins user filesystem permissions
# Ensure Jenkins runs with minimal required permissions
chown -R jenkins:jenkins $JENKINS_HOME
chmod 750 $JENKINS_HOME
chmod 750 $JENKINS_HOME/plugins
# Enable audit logging for file system changes
auditctl -w $JENKINS_HOME/plugins -p wa -k jenkins_plugins
auditctl -w $JENKINS_HOME/init.groovy.d -p wa -k jenkins_scripts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
