CVE-2021-21698: Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files
Summary
CVE-2021-21698: Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files. Affects org.jenkins-ci.plugins:subversion versions < 2.15.1. Fixed in 2.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Subversion Plugin is a Maven package (org.jenkins-ci.plugins:subversion) that provides integration with the Subversion version control system. It allows Jenkins users to checkout, update, and commit files to a Subversion repository. The plugin is widely used in software development projects to manage source code and track changes. However, versions 2.15.0 and earlier of the Subversion Plugin are vulnerable to a path traversal attack.
Vulnerability Detail
The path traversal vulnerability in the Jenkins Subversion Plugin allows an attacker who can control agent processes to read arbitrary files on the Jenkins controller file system. This vulnerability arises from the plugin's failure to restrict the name of a file when looking up a Subversion key file on the controller from an agent. By exploiting this vulnerability, an attacker can access sensitive files on the Jenkins controller, potentially leading to unauthorized disclosure of confidential information or the execution of malicious code.
How To Fix
Latest published version: 1327.vc36e0019a_653 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.15.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the Subversion Plugin is not immediately feasible, a temporary workaround is to restrict access to the Jenkins controller file system and ensure that only trusted agents have access. Additionally, it is recommended to review and restrict the permissions of sensitive files and directories to minimize the impact of a potential path traversal attack.
Conclusion
The path traversal vulnerability in the Jenkins Subversion Plugin (org.jenkins-ci.plugins:subversion) allows attackers to read arbitrary files on the Jenkins controller file system. Upgrading to version 2.15.1 or later of the plugin fixes this vulnerability by implementing proper file name restrictions. If immediate upgrade is not possible, restricting access to the file system and reviewing permissions can provide temporary mitigation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:subversion →
FAQ
The vulnerability allows an attacker to read arbitrary files on the Jenkins controller file system, potentially leading to unauthorized disclosure of sensitive information or the execution of malicious code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are detected.
Yes, upgrading the Subversion Plugin to version 2.15.1 or later fixes this vulnerability. It is recommended to update to the latest version to ensure the security of your Jenkins installation.
Yes, a temporary workaround is to restrict access to the Jenkins controller file system and ensure that only trusted agents have access. Additionally, review and restrict the permissions of sensitive files and directories to minimize the impact of a potential path traversal attack.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to promptly apply the recommended fix or workaround to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:subversion.
