CVE-2026-84671: Jenkins File Parameter Plugin RCE Vulnerability

CVE-2026-84671 Overview

CVE-2026-84671 is a path traversal vulnerability in the Jenkins File Parameter Plugin version 425.v3fa_801681b_5e and earlier. The flaw allows authenticated attackers to write files to arbitrary locations on the Jenkins controller file system through Stapler data binding. Attackers can leverage this primitive to achieve remote code execution on the Jenkins controller. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers can write arbitrary files to the Jenkins controller file system, enabling remote code execution and full compromise of the CI/CD pipeline.

Affected Products

Jenkins File Parameter Plugin version 425.v3fa_801681b_5e and earlier
Jenkins controller instances with the File Parameter Plugin installed
CI/CD environments relying on file parameter functionality in Jenkins jobs

Discovery Timeline

2026-09-02 - Jenkins Security Advisory published as SECURITY-4093
2026-09-02 - CVE-2026-84671 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84671

Vulnerability Analysis

The Jenkins File Parameter Plugin accepts file uploads as part of parameterized build definitions. The plugin uses Stapler, the web framework Jenkins relies on for HTTP request routing and data binding. During data binding, user-supplied input controls the destination path where uploaded files are written on the controller file system.

The plugin fails to validate or sanitize path components in the file name field. An authenticated attacker with permission to configure or trigger a job can supply path traversal sequences such as ../ in the file name. Stapler binds this input directly into the plugin's file-writing routine, causing the upload to escape the intended parameter directory.

Once the attacker can write to arbitrary locations, they can drop files into directories that Jenkins loads at runtime. Writing a Groovy init script or replacing a plugin file on the controller converts the file-write primitive into remote code execution in the Jenkins controller process.

Root Cause

The root cause is missing path validation during Stapler data binding in the File Parameter Plugin. The plugin trusts client-controlled file name metadata and passes it to file system APIs without normalizing the path or restricting writes to an allowlisted directory.

Attack Vector

The attack requires network access to the Jenkins web interface and low-privilege authenticated access to the controller. An attacker submits a crafted request that triggers a job using file parameters. The request includes a file name containing directory traversal sequences that resolve outside the intended upload directory. The plugin writes the attacker-controlled content to the resolved path, which can be any location writable by the Jenkins controller process.

Review the Jenkins Security Advisory 2026-09-02 for the vendor's technical description of the flaw.

Detection Methods for CVE-2026-84671

Indicators of Compromise

Unexpected files appearing in Jenkins home directories such as $JENKINS_HOME/init.groovy.d/ or $JENKINS_HOME/plugins/
File Parameter Plugin upload requests containing ../ or encoded traversal sequences in the file name field
New or modified Groovy scripts on the controller that were not created by administrators
Jenkins controller processes spawning unexpected child processes such as shells or scripting interpreters

Detection Strategies

Inspect Jenkins access logs for POST requests to buildWithParameters and file parameter endpoints containing suspicious file name values
Monitor the Jenkins controller file system for writes outside expected workspace and parameter directories
Alert on modifications to init.groovy.d, plugin directories, and Jenkins configuration files outside change windows

Monitoring Recommendations

Ingest Jenkins controller audit logs and file system telemetry into a centralized SIEM for correlation across builds
Baseline normal file parameter usage per job and alert on deviations in destination paths or file names
Track plugin inventory and version drift on all Jenkins controllers to identify vulnerable installations

How to Mitigate CVE-2026-84671

Immediate Actions Required

Identify all Jenkins controllers running the File Parameter Plugin version 425.v3fa_801681b_5e or earlier and prioritize them for patching
Restrict Job/Configure and Job/Build permissions to trusted users while a patch is being deployed
Review the Jenkins controller file system and audit logs for signs of arbitrary file writes since the plugin was installed

Patch Information

Apply the fixed release of the Jenkins File Parameter Plugin as published in the Jenkins Security Advisory 2026-09-02. Upgrade the plugin through the Jenkins Update Center and restart the controller to load the patched version.

Workarounds

Uninstall or disable the File Parameter Plugin on controllers where file parameters are not required
Remove file parameter definitions from jobs and use alternative artifact transfer mechanisms until the patch is applied
Enforce least-privilege authorization so that only vetted users can configure or execute parameterized builds

bash

# List Jenkins plugins and versions to identify vulnerable installations
java -jar jenkins-cli.jar -s http://jenkins.example.local/ \
  -auth admin:$JENKINS_TOKEN list-plugins | grep -i file-parameters