Description

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T16:17:31.340Z",
  "pubdate": "2026-09-02T16:17:31.340Z",
  "executiveSummary": "The Jenkins ThinBackup plugin is susceptible to an arbitrary file system write vulnerability caused by improper Stapler data binding. This flaw allows an authenticated attacker to manipulate the plugin's backup configuration settings through crafted HTTP requests.\nBy overriding the destination directory, an attacker can redirect backup operations to arbitrary locations on the Jenkins controller. Furthermore, the vulnerability enables the inclusion of sensitive files from the controller's local file system into the generated backup archives.\nThe vulnerability affects Jenkins ThinBackup plugin version 2.1.4 and earlier. Successful exploitation grants an attacker the ability to exfiltrate sensitive configuration data, credentials, or system files by forcing the plugin to archive them into an accessible location.\nThe primary risk involves unauthorized data access and potential full system compromise, depending on the files accessible to the Jenkins process. Exploitation requires the attacker to have sufficient permissions to modify plugin configurations, making this a high-impact issue for environments with multiple Jenkins users.",
  "technicalDetails": "The vulnerability resides in the Stapler data binding mechanism employed by the Jenkins ThinBackup plugin. Stapler is the underlying web framework used by Jenkins to map HTTP requests to Java object properties. The flaw exists because the plugin fails to perform adequate input validation or authorization checks when binding request parameters to the configuration object responsible for defining backup paths.\nThe root cause is an insecure implementation of the 'doConfigure' or equivalent data-binding method, which allows an attacker to inject arbitrary string values into the plugin's configuration parameters. Specifically, the configuration object does not sanitize or restrict the destination path property, permitting the specification of arbitrary directories on the underlying host operating system.\nThe attack flow proceeds as follows: First, an authenticated attacker with access to the Jenkins configuration interface sends a crafted POST request to the ThinBackup plugin's endpoint. This request includes parameters that override the existing 'backupDirectory' setting. Due to the lack of server-side validation, the backend process accepts this user-supplied path without verifying if it resides within a safe, designated storage area.\nOnce the configuration is updated, the attacker triggers a manual backup process. The plugin, operating with the privileges of the Jenkins controller process, then initializes a backup operation targeting the attacker-defined directory. By manipulating the configuration to include sensitive file paths or directory trees, the attacker forces the plugin to read files that would otherwise be protected or restricted. These files are subsequently compressed into a backup archive.\nThe post-exploitation phase involves the attacker accessing the resulting backup archive through the Jenkins UI or another interface. Since the archive now contains the targeted sensitive files—such as SSH private keys, credentials, or system configuration files—the attacker can download the archive, extract its contents, and gain unauthorized access to the secrets contained therein. This effectively bypasses standard access control lists, as the backup process elevates the visibility of files by packaging them into a single, downloadable entity. The vulnerability is persistent until the configuration is manually corrected by an administrator."
}