CVE-2018-1000406: Path Traversal in Jenkins
Summary
CVE-2018-1000406: Path Traversal in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.138.2
>= 2.140, < 2.146
Fixed in 2.138.2 or 2.146, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for managing job configurations and scheduling builds.
Vulnerability Detail
A path traversal vulnerability exists in Jenkins versions 2.145 and earlier, as well as LTS 2.138.1 and earlier. This vulnerability allows attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory. As a result, an arbitrary file can be written on the Jenkins master when scheduling a build. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context and permissions of the affected system.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.138.22.138.2 -
>= 2.140, < 2.1462.146
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround can be implemented by restricting Job/Configure permission to trusted users only. This can be done by modifying the Jenkins security settings and carefully managing user permissions. However, this workaround should be considered temporary, and upgrading to the fixed versions is strongly advised.
Conclusion
In conclusion, the path traversal vulnerability in Jenkins can lead to unauthorized file writes and potential security breaches. It is crucial to upgrade to the fixed versions or apply the temporary workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows attackers to write arbitrary files on the Jenkins master, potentially leading to unauthorized access, data leakage, or remote code execution.
Users of Jenkins versions 2.145 and earlier, as well as LTS 2.138.1 and earlier, are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to patch the vulnerability as soon as possible to prevent potential exploitation.
No, this vulnerability requires Job/Configure permission on the Jenkins instance, which limits the potential for remote exploitation. However, it is still crucial to address the vulnerability to prevent insider threats or privilege escalation.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
