CVE-2022-25177: Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
Summary
CVE-2022-25177: Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin. Affects org.jenkins-ci.plugins.workflow:workflow-cps-global-lib across 3 version ranges.
< 2.18.1
>= 2.19, < 2.21.1
>= 2.22, < 561.va_ce0de3c2d69
Fixed in 2.18.1, 2.21.1 or 561.va_ce0de3c2d69, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Shared Groovy Libraries Plugin is a Maven package that provides functionality for managing and sharing Groovy libraries in Jenkins Pipelines. It allows users to define reusable Groovy code that can be used across multiple pipelines. This plugin is widely used in Jenkins installations for its ability to improve code reusability and maintainability in pipeline workflows.
Vulnerability Detail
The Jenkins Pipeline: Shared Groovy Libraries Plugin version 552.vd9cc05b8a2e1 and earlier is vulnerable to an improper link resolution before file access vulnerability. This vulnerability allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controller file system. The plugin follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step. This can lead to unauthorized access to sensitive files and potential information disclosure.
How To Fix
Latest published version: 636.v3d2c06d018a_6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.18.12.18.1 -
>= 2.19, < 2.21.12.21.1 -
>= 2.22, < 561.va_ce0de3c2d69561.va_ce0de3c2d69
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the use of symbolic links in the Jenkins Pipeline: Shared Groovy Libraries Plugin. This can be done by modifying the plugin configuration or by removing any symbolic links present in the Pipeline library. However, this workaround may impact the functionality and reusability of the Groovy libraries.
Conclusion
The Jenkins Pipeline: Shared Groovy Libraries Plugin is vulnerable to an improper link resolution before file access vulnerability. This can allow attackers to read arbitrary files on the Jenkins controller file system. It is recommended to upgrade to the latest version of the plugin and apply the necessary fixes to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib →
FAQ
This vulnerability allows attackers with the ability to configure Pipelines to read arbitrary files on the Jenkins controller file system. It can lead to unauthorized access to sensitive information and potential information disclosure.
No, versions 552.vd9cc05b8a2e1 and earlier are affected by this vulnerability. Users should upgrade to version 561.va_ce0de3c2d69 or later to mitigate the risk.
Yes, users can disable the use of symbolic links in the plugin configuration or remove any symbolic links present in the Pipeline library as a temporary workaround. However, this may impact the functionality and reusability of the Groovy libraries.
There are no known exploits for this vulnerability at the moment. However, it is recommended to apply the necessary fixes and security updates to prevent any potential exploitation.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-q234-x887-9rxh/GHSA-q234-x887-9rxh.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib.
