PT-2026-55125 · Maven · Org.Jenkins-Ci.Plugins:Credentials-Binding

Published 2026-05-27 · Updated 2026-05-27

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Credentials Binding Plugin 720.v3f6decef43ea and earlier does not properly sanitize file names for file and zip file credentials.

This allows attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem. If Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node, this can lead to remote code execution.

Credentials Binding Plugin 725.ve52b 2328a fde improves sanitization of the file name provided for file and zip file credentials, preventing path traversal.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-FXXF-W25W-MCX2

Affected Products

Org.Jenkins-Ci.Plugins:Credentials-Binding

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-48922 · Security Note
• https://osv.dev/vulnerability/GHSA-fxxf-w25w-mcx2 · Vendor Advisory
• https://github.com/jenkinsci/credentials-binding-plugin · Note
• https://jenkins.io/security/advisory/2026-05-27/#SECURITY-3790 · Note