Description

Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:31.737Z",
  "pubdate": "2026-09-02T16:17:31.737Z",
  "executiveSummary": "The Jenkins File Parameter Plugin (version 425.v3fa_801681b_5e and earlier) is susceptible to an arbitrary file write vulnerability resulting from improper Stapler data binding.\nThis vulnerability allows an attacker to write arbitrary files to the Jenkins controller filesystem.\nBy manipulating request parameters, an attacker can overwrite critical system configuration files or inject malicious scripts.\nThe primary risk is the attainment of Remote Code Execution (RCE) on the Jenkins controller, effectively granting the attacker full control over the Jenkins environment and potentially the underlying host operating system.\nThe exploitation does not require advanced permissions if the endpoint is exposed, although typically, an attacker would need access to the Jenkins UI.\nThis represents a critical severity issue, as it bypasses standard file handling security controls, leading to total compromise of the CI/CD pipeline integrity.",
  "technicalDetails": "The vulnerability resides within the Stapler data binding process utilized by the Jenkins File Parameter Plugin. Stapler is the core web framework used by Jenkins to map HTTP requests to Java objects. In the affected versions, the plugin fails to properly validate the file path or destination provided via incoming web request parameters.\nThe root cause is an insecure implementation of data binding where user-supplied input is directly mapped to file system operations without sufficient sanitization or path traversal protection. This allows an attacker to supply a crafted payload that instructs the Jenkins controller to write content to unintended locations outside the intended temporary directory.\nThe exploitation flow begins with an attacker identifying a form or API endpoint that utilizes the File Parameter Plugin. By intercepting the multipart/form-data request, the attacker modifies the parameter associated with the file upload. By using directory traversal sequences (e.g., ../../), the attacker can escape the restricted sandbox or temporary storage directories assigned to the plugin.\nBecause Jenkins controllers often run with the permissions of the service user (frequently a highly privileged account on the host), an arbitrary write allows for the modification of sensitive files. Specifically, an attacker can overwrite existing configuration files, plugins, or even inject malicious Groovy scripts into the Jenkins home directory.\nOnce a malicious payload is successfully written to a location such as the 'jobs' configuration directory or a script startup directory, the Jenkins controller will execute the injected code upon the next execution cycle, service restart, or configuration reload. This facilitates full Remote Code Execution.\nThe vulnerability is accessible via the network to any user or entity capable of interacting with the affected Jenkins web interface. No specialized bypasses are required beyond standard request manipulation, making it a high-risk vector for both authenticated and potentially unauthenticated attackers, depending on the specific Jenkins security configuration.\nPost-exploitation impact includes persistent backdoor installation, exfiltration of build secrets, lateral movement within the infrastructure, and total loss of CI/CD pipeline integrity."
}