PT-2026-51806 · Jenkins · Jenkins External Workspace Manager Plugin

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-57296

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-57296

Affected Products

Jenkins External Workspace Manager Plugin

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-57296 · Security Note
• https://jenkins.io/security/advisory/2026-06-24/#SECURITY-3777 · Vendor Advisory