CVE-2014-3664: Jenkins Path Traversal vulnerability in org.jenkins-ci.main:jenkins-core
Summary
CVE-2014-3664: Jenkins Path Traversal vulnerability. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.565.3
>= 1.566, < 1.583
Fixed in 1.565.3 or 1.583, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package, org.jenkins-ci.main:jenkins-core, is a core component of Jenkins responsible for its fundamental functionality.
Vulnerability Detail
The Jenkins Path Traversal vulnerability, identified as CVE-2014-3664, allows remote authenticated users with the Overall/READ permission to read arbitrary files through unspecified vectors. This means that an attacker with the necessary permissions can exploit this vulnerability to access sensitive files on the system, potentially leading to unauthorized disclosure of information or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.565.31.565.3 -
>= 1.566, < 1.5831.583
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to restrict the Overall/READ permission for remote authenticated users. By limiting their access rights, the risk of exploitation can be mitigated. However, this workaround may impact legitimate user functionality, so upgrading to a fixed version is still strongly recommended.
Conclusion
The Jenkins Path Traversal vulnerability in the org.jenkins-ci.main:jenkins-core package allows remote authenticated users to read arbitrary files, potentially leading to unauthorized disclosure of sensitive information or other malicious activities. It is crucial to upgrade to a fixed version of the package to patch this vulnerability. If immediate upgrading is not possible, restricting the Overall/READ permission for remote authenticated users can provide temporary mitigation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows remote authenticated users to read arbitrary files, potentially leading to unauthorized disclosure of sensitive information or other malicious activities.
Remote authenticated users with the Overall/READ permission can exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at this time.
Yes, upgrading to versions 1.583 and later for Jenkins before 1.583, and versions 1.565.3 and later for LTS before 1.565.3 will fix this vulnerability.
If upgrading is not immediately feasible, you can mitigate the risk by restricting the Overall/READ permission for remote authenticated users. However, upgrading to a fixed version is still strongly recommended.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
