CVE-2018-1000997: Improper Limitation of a Pathname to a Restricted Directory in Jenkins
Summary
CVE-2018-1000997: Improper Limitation of a Pathname to a Restricted Directory in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.138.2
>= 2.140, < 2.146
Fixed in 2.138.2 or 2.146, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The Jenkins Core package, specifically versions 2.145 and earlier, LTS 2.138.1 and earlier, is affected by a path traversal vulnerability in the Stapler web framework. This vulnerability allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed.
Vulnerability Detail
The vulnerability arises from improper limitation of a pathname to a restricted directory in several files of the Stapler web framework used by Jenkins. The affected files include Facet.java, GroovyFacet.java, JellyFacet.java, JRubyFacet.java, and JSPFacet.java. By exploiting this vulnerability, an attacker can access and view internal information about objects in Jenkins that are not meant to be exposed. This information can include sensitive data or details that may aid in further attacks. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.138.22.138.2 -
>= 2.140, < 2.1462.146
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can implement access controls and restrict access to sensitive information within Jenkins. This can be achieved by configuring appropriate permissions and user roles to limit the visibility of internal objects. Additionally, regular monitoring and auditing of Jenkins logs can help detect any unauthorized access attempts or suspicious activities.
Conclusion
The path traversal vulnerability in Jenkins Core versions 2.145 and earlier, LTS 2.138.1 and earlier, can allow unauthorized access to internal information about objects in Jenkins. It is crucial to update to the recommended versions or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery processes. It helps developers build, test, and deploy their software projects efficiently.
The Stapler web framework is a component used by Jenkins to handle web requests and render views. It provides functionality for routing and processing HTTP requests.
A path traversal vulnerability occurs when an attacker can navigate outside the intended directory structure and access files or directories that are not meant to be exposed. In the case of Jenkins, this vulnerability allows unauthorized access to internal information about objects.
The vulnerability can expose sensitive information about objects in Jenkins, which may aid attackers in further exploiting the system. This can lead to unauthorized access, data leakage, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this specific issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
