CVE-2026-70428: Jenkins Path Traversal Vulnerability

CVE-2026-70428 Overview

CVE-2026-70428 is a path traversal vulnerability [CWE-22] affecting Jenkins 2.575 and earlier, and Jenkins LTS 2.568.1 and earlier. The flaw stems from improper identification of file paths in file parameter names during build processing. Authenticated attackers holding Item/Configure and Item/Build permissions can write files to arbitrary locations on the Jenkins controller file system. The issue is tracked as SECURITY-3927 in the Jenkins security advisory dated 2026-08-05.

Critical Impact
Attackers with build configuration privileges can write arbitrary files to the Jenkins controller, potentially overwriting configuration files, plugins, or scripts to escalate control of the automation server.

Affected Products

Jenkins weekly releases 2.575 and earlier
Jenkins LTS 2.568.1 and earlier
Jenkins controller file parameter handling component

Discovery Timeline

2026-08-05 - Jenkins publishes Security Advisory SECURITY-3927
2026-08-05 - CVE-2026-70428 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70428

Vulnerability Analysis

Jenkins allows build definitions to declare file parameters that users supply at build time. The controller stores these files using the supplied parameter name to derive the destination path. In vulnerable versions, the validation logic that inspects the parameter name for path traversal sequences fails to correctly identify all forms of traversal input. An attacker can craft a file parameter name containing traversal segments that pass validation but resolve to a location outside the intended workspace when the file is written.

The vulnerability requires authentication and elevated in-project privileges. Attackers must hold both Item/Configure to define the malicious file parameter and Item/Build to trigger the write. The impact is bounded to integrity: attackers can create or overwrite files but the flaw itself does not disclose data or crash the service. Writing to sensitive paths such as init.groovy.d, plugin directories, or config.xml can convert this integrity primitive into full controller takeover.

Root Cause

The root cause is insufficient sanitization of file parameter names. The Jenkins core parameter-processing code inspects names for traversal patterns but the check is incomplete, allowing crafted names to reach the file-write operation with directory components intact.

Attack Vector

An authenticated attacker with Item/Configure permission on any job creates or edits a build to include a file parameter whose name encodes path traversal. Triggering a build with Item/Build permission causes Jenkins to write the uploaded file to the traversed location under the controller process account.

No verified public exploit code is available. See the Jenkins Security Advisory #2026-08-05 for the authoritative technical description.

Detection Methods for CVE-2026-70428

Indicators of Compromise

Unexpected files appearing in Jenkins controller directories such as $JENKINS_HOME/init.groovy.d/, $JENKINS_HOME/plugins/, or $JENKINS_HOME/users/
Modifications to config.xml or job config.xml files that do not correlate with an administrator action in the audit log
Build parameter definitions where the file parameter name field contains ../, ..\, encoded traversal sequences, or absolute path prefixes

Detection Strategies

Review job configuration history for file parameter definitions with suspicious names containing path separators or traversal tokens
Correlate build execution events with file-system change events on the controller outside the expected workspace directory
Alert on process activity where the Jenkins controller writes to paths outside $JENKINS_HOME/jobs/*/workspace/ and $JENKINS_HOME/jobs/*/builds/

Monitoring Recommendations

Enable file integrity monitoring on $JENKINS_HOME with emphasis on init.groovy.d, plugins, secrets, and root-level configuration files
Forward Jenkins audit logs and controller host telemetry to a centralized data lake for cross-source correlation
Track users granted Item/Configure and Item/Build and review their build activity for anomalous parameter names

How to Mitigate CVE-2026-70428

Immediate Actions Required

Upgrade Jenkins weekly to a release later than 2.575 that includes the SECURITY-3927 fix
Upgrade Jenkins LTS to a release later than 2.568.1 that includes the SECURITY-3927 fix
Audit which users and service accounts hold Item/Configure and Item/Build and revoke where not required
Inspect existing jobs for file parameters with names containing traversal characters and remove them

Patch Information

Jenkins addressed CVE-2026-70428 in the releases identified in the Jenkins Security Advisory #2026-08-05. Apply the vendor-supplied update as the primary remediation. No standalone hotfix is described in the advisory.

Workarounds

Restrict Item/Configure to trusted administrators until the patch is applied
Avoid granting Item/Build to accounts that also hold Item/Configure on the same job where possible
Run the Jenkins controller under a low-privilege OS account with strict file-system permissions on $JENKINS_HOME to limit blast radius

bash

# Verify running Jenkins version and plan upgrade
curl -sI http://jenkins.example.local/ | grep -i '^X-Jenkins:'

# Enumerate jobs whose config.xml declares a FileParameterDefinition
grep -RIl 'FileParameterDefinition' "$JENKINS_HOME/jobs/" \
  | xargs -I{} grep -H '<name>' {}