Description

An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T13:17:58.940Z",
  "pubdate": "2026-08-10T13:17:58.940Z",
  "executiveSummary": "CVE-2026-33001 represents an incomplete patch vulnerability affecting Jenkins through LTS 2.555.3, specifically involving arbitrary file read capabilities on the Jenkins controller filesystem via crafted tar archives. The vulnerability stems from the implementation of symlink validation within the archiving and extraction logic, where the destination of the symlink is validated during extraction in FilePath.java, but the actual symlink target remains unchecked. Consequently, an authenticated remote attacker possessing Item/Configure permission can leverage this flaw to point a symlink located within the workspace to arbitrary paths outside the workspace boundary. Successful exploitation results in the unauthorized disclosure of sensitive files readable by the Jenkins process user, including critical secrets such as secrets/master.key and credentials.xml. The risk implication is severe, as it allows authenticated users with specific configuration privileges to bypass sandbox boundaries and expose confidential system data. Exploitation requires authenticated remote access with Item/Configure privileges and the ability to upload or process a crafted tar archive.",
  "technicalDetails": "The vulnerability resides in the FilePath.java component of Jenkins through LTS 2.555.3, specifically within the logic responsible for handling tar archive extraction. The root cause of CVE-2026-33001 is an insufficient validation mechanism introduced in a previous security update intended to address path traversal and symlink vulnerabilities. While the patch correctly validates symlink destinations during the extraction process, it fails to comprehensively validate symlink targets. Because the target evaluation is flawed, a malicious actor can construct a payload where a symlink is initialized inside a permitted workspace directory, yet its target points to arbitrary locations residing outside the designated workspace boundaries on the Jenkins controller filesystem. The attack flow begins with an authenticated remote attacker who holds Item/Configure permissions within the Jenkins environment. The attacker crafts a malicious tar archive containing specially manipulated symbolic links designed to reference sensitive system files. Upon uploading or processing this crafted tar archive within Jenkins, the vulnerable extraction routine in FilePath.java processes the archive entries. Because the symlink target validation is inadequate, the extraction succeeds in creating the malicious symbolic link within the workspace pointing to locations outside the sandbox. Once the symbolic link is established, the attacker can subsequently read the contents of the targeted arbitrary files through standard file access interfaces that resolve the symlink. The post-exploitation impact includes the exposure of any file readable by the underlying OS user running the Jenkins process. This encompasses highly sensitive operational data, including secrets/master.key, credentials.xml, and other critical configuration files that may facilitate further compromise or credential theft across the Jenkins instance."
}