CVE-2026-84667: Jenkins ThinBackup Plugin Path Traversal

CVE-2026-84667 Overview

CVE-2026-84667 affects the Jenkins ThinBackup Plugin version 2.1.4 and earlier. The vulnerability allows authenticated attackers to overwrite the plugin's backup configuration through Stapler data binding. Attackers can redirect backup writes to an attacker-controlled directory. They can also include arbitrary files from the Jenkins controller file system in backups, enabling exposure of sensitive data. The flaw is classified under [CWE-22] (Path Traversal) and stems from insufficient validation of user-supplied configuration parameters bound via Stapler.

Critical Impact
Authenticated attackers can redirect Jenkins backup output to arbitrary filesystem locations and include sensitive controller files, exposing credentials, keys, and configuration data.

Affected Products

Jenkins ThinBackup Plugin 2.1.4 and earlier
Jenkins controllers with the ThinBackup Plugin installed
Environments where low-privileged authenticated users can access plugin configuration endpoints

Discovery Timeline

2026-09-02 - CVE-2026-84667 published to NVD
2026-09-02 - Jenkins Security Advisory SECURITY-4099 released
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84667

Vulnerability Analysis

The Jenkins ThinBackup Plugin exposes configuration properties that are bound directly from HTTP request parameters through the Stapler web framework. Stapler data binding populates plugin configuration fields without enforcing permission checks or sanitizing filesystem paths. An authenticated attacker can craft requests that mutate the backup directory setting and file inclusion patterns. This changes where the plugin writes backup archives and which files it collects from the Jenkins controller. The result is a path traversal condition combined with arbitrary file read exposure through backup archives.

Root Cause

The root cause is missing authorization and validation on configuration properties reachable through Stapler data binding. The plugin trusts inbound property values without confirming that the caller holds administrative permissions. It also does not constrain the backup directory to an allowed base path. This aligns with [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires network access to the Jenkins controller and low-privileged authenticated access. An attacker submits crafted POST parameters that Stapler binds to the ThinBackup configuration. The attacker sets the backup path to a directory they control or a sensitive location. On the next backup execution, the plugin writes to the attacker-specified directory and can package arbitrary controller files into the archive. Refer to the Jenkins Security Advisory SECURITY-4099 for technical details.

Detection Methods for CVE-2026-84667

Indicators of Compromise

Unexpected modifications to the ThinBackup configuration file, including changes to the backup directory path or file inclusion patterns
Backup archives created in non-standard filesystem locations outside the configured Jenkins home
Access logs showing POST requests to ThinBackup configuration endpoints from non-administrative user accounts
Backup archives containing files outside the normal Jenkins job and configuration scope

Detection Strategies

Audit Jenkins access logs for requests to ThinBackup plugin URLs originating from accounts that lack the Overall/Administer permission
Monitor the Jenkins controller filesystem for new writable directories created by the Jenkins service account
Compare current ThinBackup configuration against a known-good baseline to identify unauthorized parameter changes

Monitoring Recommendations

Forward Jenkins audit logs to a centralized logging platform and alert on ThinBackup configuration changes
Track file system writes by the Jenkins process to paths outside expected backup destinations
Review installed plugin versions during routine security assessments to identify vulnerable ThinBackup installations

How to Mitigate CVE-2026-84667

Immediate Actions Required

Inventory all Jenkins controllers to identify installations running ThinBackup Plugin 2.1.4 or earlier
Restrict access to Jenkins to trusted authenticated users and review the permission matrix for non-administrative accounts
Review current ThinBackup configuration for unauthorized modifications to backup paths or inclusion patterns
Rotate any credentials, tokens, or keys stored on the Jenkins controller if unauthorized backups are suspected

Patch Information

Refer to the Jenkins Security Advisory SECURITY-4099 for the fixed version and upgrade instructions. Apply the vendor-supplied update through the Jenkins Plugin Manager as soon as it is available in the target environment.

Workarounds

Disable the ThinBackup Plugin until the patched version can be deployed
Enforce least privilege by removing any non-administrative permissions that allow access to plugin configuration endpoints
Isolate the Jenkins controller on a restricted network segment to limit exposure from authenticated users

bash

# Configuration example
# List installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ list-plugins | grep thinBackup

# Disable the ThinBackup plugin as a temporary workaround
java -jar jenkins-cli.jar -s https://jenkins.example.com/ disable-plugin thinBackup -restart