CVE-2019-16540: Jenkins Support Core Plugin Arbitrary File Deletion
Summary
CVE-2019-16540: Jenkins Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files. Affects org.jenkins-ci.plugins:support-core versions < 2.64. Fixed in 2.64. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Support Core Plugin is a component of the Jenkins automation server that provides support bundle generation and management. It allows users to collect diagnostic information and troubleshoot issues in Jenkins. The plugin is an essential part of maintaining the stability and performance of Jenkins installations.
Vulnerability Detail
The Jenkins Support Core Plugin was found to have a vulnerability that allowed users with Overall/Read permission to delete arbitrary files on the Jenkins controller file system. The plugin did not properly validate the paths submitted for the "Delete Support Bundles" feature, enabling users to delete any file accessible to the OS user account running Jenkins. Additionally, the endpoint responsible for this feature did not perform a permission check, allowing users to delete support bundles and other files with a known name/path. This vulnerability could lead to unauthorized deletion of critical files and potential disruption of Jenkins functionality.
How To Fix
Latest published version: 1865.v45d40b_778b_cb_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.64
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Jenkins Support Core Plugin to the latest version to mitigate the risk of arbitrary file deletion.
Conclusion
The Jenkins Support Core Plugin version 2.63 and earlier are vulnerable to arbitrary file deletion. It is crucial to update the plugin to version 2.64 or later to fix this vulnerability. Failure to do so may result in unauthorized file deletion and potential disruption of Jenkins functionality. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:support-core →
FAQ
This vulnerability allows users with Overall/Read permission to delete arbitrary files on the Jenkins controller file system. It can lead to unauthorized deletion of critical files and potential disruption of Jenkins functionality.
Users of Jenkins installations with the Jenkins Support Core Plugin version 2.63 or earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, updating the Jenkins Support Core Plugin to version 2.64 or later fixes this vulnerability.
No, updating the Jenkins Support Core Plugin to the latest version is the only way to mitigate this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:support-core.
