CVE-2026-70428: 
Jenkins vulnerability analysis and mitigation

CVE-2026-70428 is a path traversal vulnerability (SECURITY-3927) in Jenkins core that allows authenticated attackers to write files to arbitrary locations on the Jenkins controller file system. It affects Jenkins weekly releases up to and including 2.575, and LTS releases up to and including 2.568.1. The vulnerability was disclosed on August 5, 2026, as part of a broader Jenkins security advisory. It carries a CVSS v3.1 base score of 4.3 (Medium), though the Jenkins advisory rates its severity as High due to the potential for code execution (Jenkins Advisory, GitHub Advisory).

The root cause is improper validation of file parameter names when handling path traversal sequences (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). Jenkins fails to correctly identify and reject path traversal attempts embedded in file parameter names during job configuration and build execution. An authenticated attacker with both Item/Configure and Item/Build permissions can craft a malicious file parameter name containing traversal sequences (e.g., ../../) that bypass Jenkins' path sanitization logic, causing uploaded file content to be written outside the intended workspace directory. The write operation is restricted only by the OS-level file system permissions of the user account running Jenkins, meaning sensitive directories such as JENKINS_HOME/init.groovy.d/ or JENKINS_HOME/plugins/ may be reachable (Jenkins Advisory, Red Hat Bugzilla). The vulnerability was reported by Samy Medjahed (Ap4sh) and Eliott Laurie (Ethicxz) through the Jenkins Bug Bounty Program sponsored by the European Commission (Jenkins Advisory).

Successful exploitation allows an authenticated attacker to write arbitrary files anywhere on the Jenkins controller file system that the Jenkins process user can access. The most critical consequence is code execution: an attacker can write a malicious Groovy script to JENKINS_HOME/init.groovy.d/ (executed on Jenkins startup) or deploy a malicious plugin to JENKINS_HOME/plugins/, ultimately achieving full controller compromise. While the direct CVSS impact is limited to integrity (no confidentiality or availability impact in isolation), the chained effect of arbitrary file write to code execution significantly elevates the real-world risk, potentially enabling lateral movement to connected systems, credential theft from the Jenkins credential store, and supply chain attacks against CI/CD pipelines (Jenkins Advisory, Feedly).

As of the advisory publication date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). CISA's SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for authenticated access with specific permissions (Item/Configure and Item/Build) (NVD). The EPSS score is approximately 0.245%, placing it in the 16th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Gain authenticated access: Obtain or compromise a Jenkins account that holds both Item/Configure and Item/Build permissions on at least one job. This could be achieved through credential theft, phishing, or abuse of overly permissive role assignments.
2. Create or modify a job with a file parameter: Navigate to a Jenkins job's configuration page and add a File Parameter. Set the parameter name to a path traversal string such as ../../init.groovy.d/malicious.groovy instead of a simple filename.
3. Craft a malicious payload file: Prepare a file containing a Groovy script that executes attacker-controlled commands (e.g., a reverse shell or credential exfiltration script) when loaded by Jenkins.
4. Trigger a build with the malicious file: Initiate a build of the configured job, supplying the crafted payload file as the value for the traversal-named file parameter. Jenkins improperly validates the parameter name and writes the file to the traversal-resolved path on the controller (e.g., JENKINS_HOME/init.groovy.d/malicious.groovy).
5. Achieve code execution: Restart Jenkins (or wait for a scheduled restart) to trigger execution of the dropped Groovy script from init.groovy.d/, or wait for the deployed plugin to be loaded, resulting in arbitrary code execution on the Jenkins controller (Jenkins Advisory).

• File System: Unexpected .groovy files appearing in JENKINS_HOME/init.groovy.d/; new or modified .jpi/.hpi files in JENKINS_HOME/plugins/ not corresponding to legitimate plugin updates; files with path traversal artifacts in job workspace directories.
• Logs: Jenkins build logs showing file parameter names containing ../ or URL-encoded equivalents (e.g., %2e%2e%2f); audit log entries showing Item/Configure or Item/Build actions by low-privilege accounts followed by unexpected file system changes.
• Process: Unusual processes spawned by the Jenkins JVM after a restart, particularly network connections to external hosts initiated by the Jenkins service account; unexpected Groovy script execution events in Jenkins system logs.
• Network: Outbound connections from the Jenkins controller to unknown external IP addresses or domains, especially shortly after a Jenkins restart following a suspicious build execution.

The primary remediation is to upgrade Jenkins to version 2.576 (weekly) or 2.568.2 (LTS), which improves identification of path traversal attempts in file parameter names and prevents writing files to arbitrary locations (Jenkins Advisory). As a workaround for environments that cannot immediately upgrade, restrict Item/Configure and Item/Build permissions to only fully trusted users, as both permissions are required for exploitation. Additionally, review all existing job configurations for file parameters with suspicious names, disable file parameters where not operationally required, and monitor the Jenkins controller file system — particularly JENKINS_HOME/init.groovy.d/ and JENKINS_HOME/plugins/ — for unauthorized modifications.

The vulnerability was disclosed as part of a large Jenkins security advisory on August 5, 2026, covering over 20 CVEs across Jenkins core and multiple plugins, which drew broad coverage from security news outlets. SecurityOnline.info covered the advisory in the context of the more critical RCE vulnerability (CVE-2026-70426) disclosed in the same batch (SecurityOnline). SecureReading.com also published a summary of the Jenkins security update (SecureReading). The vulnerability was reported through the Jenkins Bug Bounty Program sponsored by the European Commission, reflecting the program's continued effectiveness in surfacing core security issues (Jenkins Advisory).