CVE-2018-1000194: Path Traversal in Jenkins
Summary
CVE-2018-1000194: Path Traversal in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.107.3
>= 2.108, < 2.121
Fixed in 2.107.3 or 2.121, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The Jenkins core package, specifically the 'jenkins-core' module, is responsible for the fundamental functionality of the Jenkins server. This vulnerability affects Jenkins versions 2.120 and older, as well as LTS 2.107.2 and older. It is related to the FilePath.java and SoloFilePathFilter.java files, which allow malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Vulnerability Detail
The path traversal vulnerability in Jenkins allows unauthorized agents to access and manipulate files on the Jenkins master. By exploiting this vulnerability, an attacker can read sensitive information or modify critical files, potentially leading to unauthorized access, data leakage, or system compromise. The vulnerability is rated as HIGH severity with a CVSS score of 8.1. It falls under the CWE-22 category, which refers to improper limitation of a path name to a restricted directory.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.107.32.107.3 -
>= 2.108, < 2.1212.121
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, a temporary workaround is to restrict access to the Jenkins master from untrusted agents. This can be achieved by configuring network-level access controls or firewall rules to limit agent connections to trusted sources only. Additionally, it is recommended to monitor the Jenkins master for any suspicious activity or unauthorized file modifications.
Conclusion
The path traversal vulnerability in Jenkins exposes the server to potential unauthorized access and data manipulation. It is crucial to promptly upgrade Jenkins to the recommended versions or apply the necessary security patches. Regularly monitoring for suspicious activity and keeping Jenkins and its plugins up to date are essential security practices. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows malicious agents to read and write arbitrary files on the Jenkins master, potentially leading to unauthorized access, data leakage, or system compromise.
No, only Jenkins versions 2.120 and older, as well as LTS 2.107.2 and older, are affected. Upgrading to the latest versions will address the vulnerability.
Yes, the vulnerability can be exploited remotely by malicious agents. It is important to apply the necessary security patches or upgrade to the latest Jenkins version to mitigate the risk.
There have been reports of active exploitation of this vulnerability in the wild. It is crucial to take immediate action to secure Jenkins installations.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
