CVE-2019-10352: Improper Limitation of a Pathname to a Restricted Directory in Jenkins
Summary
CVE-2019-10352: Improper Limitation of a Pathname to a Restricted Directory in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.176.2
>= 2.177, < 2.186
Fixed in 2.176.2 or 2.186, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that allows developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for handling file parameters in build configurations.
Vulnerability Detail
The vulnerability, identified as CVE-2019-10352, is a path traversal flaw that affects Jenkins versions 2.185 and earlier, as well as LTS 2.176.1 and earlier. It resides in the 'FileParameterValue.java' file of the Jenkins core. Attackers with Job/Configure permission can exploit this vulnerability by defining a file parameter with a file name outside the intended directory. This can lead to arbitrary file write operations on the Jenkins master when scheduling a build. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.176.22.176.2 -
>= 2.177, < 2.1862.186
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by upgrading to the patched versions is the best course of action.
Conclusion
In conclusion, the vulnerability CVE-2019-10352 in Jenkins allows attackers to write arbitrary files on the Jenkins master. To mitigate this issue, it is crucial to upgrade to the fixed versions mentioned above. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
The vulnerable package is 'org.jenkins-ci.main:jenkins-core', which is a core component responsible for handling file parameters in build configurations.
The vulnerability allows attackers with Job/Configure permission to write arbitrary files on the Jenkins master, potentially leading to unauthorized access or data manipulation.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
To fix this vulnerability, it is recommended to upgrade Jenkins to version 2.176.2 or later (for LTS) or version 2.186 or later (for non-LTS).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
