CVE-2018-6356: Improper Limitation of a Pathname to a Restricted Directory in Jenkins

org.jenkins-ci.main:jenkins-core Updated 02 Oct 2025

Summary

13/05/2022

Disclosed on

CVE-2018-6356

CVE

Yes i

Fix available

Moderate

Severity

6.5

CVSS Score

CVE-2018-6356: Improper Limitation of a Pathname to a Restricted Directory in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.

< 2.89.4 >= 2.90, < 2.107

Fixed in 2.89.4 or 2.107, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and features to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionality.

Vulnerability Detail

The vulnerability identified as CVE-2018-6356 in Jenkins versions before 2.107 and Jenkins LTS before 2.89.4 allows users with Overall/Read permission to download files from the Jenkins master that they should not have access to. This vulnerability arises from the improper prevention of specifying relative paths that escape a base directory for URLs accessing plugin resource files. On Windows, any file accessible to the Jenkins master process could be downloaded, while on other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.

How To Fix

Latest published version: 2.587 as of 22 Oct 2026

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 2.89.4 2.89.4
>= 2.90, < 2.107 2.107

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading Jenkins is not immediately feasible, a temporary workaround can be implemented by restricting access to the Jenkins master process. This can be achieved by ensuring that only trusted users have access to the Jenkins home directory or by isolating the Jenkins master process from sensitive files and directories.

Conclusion

In conclusion, the vulnerability identified as CVE-2018-6356 in Jenkins versions before 2.107 and Jenkins LTS before 2.89.4 allows unauthorized file downloads by users with Overall/Read permission. It is crucial to upgrade Jenkins to the recommended versions or implement the provided workaround to mitigate the risk of exploitation. For further assistance or support in addressing this vulnerability, please reach out to DevNack.com.

See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →

FAQ

What is the impact of this vulnerability?

This vulnerability allows unauthorized users to download files from the Jenkins master that they should not have access to. The impact can vary depending on the specific files accessible to the Jenkins master process, but it could potentially lead to the exposure of sensitive information or unauthorized access to restricted resources.

Who is affected by this vulnerability?

Users of Jenkins versions before 2.107 and Jenkins LTS before 2.89.4 are affected by this vulnerability. Specifically, users with Overall/Read permission are at risk of unauthorized file downloads.

Are there any known exploits for this vulnerability?

There are no known public exploits for this vulnerability at the time of this report. However, it is important to promptly apply the recommended fixes to mitigate the risk of potential exploitation.

Can this vulnerability be exploited remotely?

No, this vulnerability requires authenticated access to the Jenkins instance with Overall/Read permission. It cannot be exploited remotely without valid credentials.