PT-2026-26073 · Jenkins+1 · Jenkins+1

Elie Metahri + 3 · Publicado 2026-03-18 · Atualizado 2026-05-24 · CVE-2026-33001

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.554 and earlier Jenkins LTS versions 2.541.2 and earlier

Description The software does not safely handle symbolic links when extracting .tar and .tar.gz archives. This allows crafted archives to write files to arbitrary locations on the filesystem, limited by the file system access permissions of the user running Jenkins. An attacker with Item/Configure permission, or control over agent processes, can exploit this to deploy malicious scripts or plugins on the controller.

Recommendations Update Jenkins to a version later than 2.554. Update Jenkins LTS to a version later than 2.541.2.

Correção

RCE

DoS

Link Following

Enumeração de Fraquezas

CWE-61

CWE-59

Identificadores relacionados

BDU:2026-04250

BIT-JENKINS-2026-33001

CVE-2026-33001

GHSA-R6QV-FRPC-Q66C

Produtos afetados

Jenkins

Red Os

Referências · 18

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/6dc99937605d5bddfeaae43a4cd14c2571e23adc · Nota
• https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.555 · Nota
• https://bdu.fstec.ru/vul/2026-04250 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-r6qv-frpc-q66c · Aviso do Fabricante
• https://jenkins.io/security/advisory/2026-03-18/#SECURITY-3657 · Aviso do Fabricante
• https://twitter.com/threatcluster/status/2034963249989333434 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2043165418085343669 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034365286221230173 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33001 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-jenkins-cve-2026-33001-8.0 · Nota
• https://twitter.com/autumn_good_35/status/2035397193222508898 · Publicação no Twitter
• https://twitter.com/AndreGironda/status/2034745679927775725 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33001 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-jenkins-2026-33001 · Aviso do Fabricante