PT-2026-55125 · Maven · Org.Jenkins-Ci.Plugins:Credentials-Binding

Publicado 2026-05-27 · Atualizado 2026-05-27

OSV

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Credentials Binding Plugin 720.v3f6decef43ea and earlier does not properly sanitize file names for file and zip file credentials.

This allows attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem. If Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node, this can lead to remote code execution.

Credentials Binding Plugin 725.ve52b 2328a fde improves sanitization of the file name provided for file and zip file credentials, preventing path traversal.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

GHSA-FXXF-W25W-MCX2

Produtos afetados

Org.Jenkins-Ci.Plugins:Credentials-Binding

Referências · 4

• https://github.com/jenkinsci/credentials-binding-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-48922 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fxxf-w25w-mcx2 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2026-05-27/#SECURITY-3790 · Nota