CVE-2022-25178: Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
Summary
CVE-2022-25178: Jenkins Pipeline: Shared Groovy Libraries Plugin does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenki... Affects org.jenkins-ci.plugins.workflow:workflow-cps-global-lib across 3 version ranges.
< 2.18.1
>= 2.19, < 2.21.1
>= 2.22, < 561.va_ce0de3c2d69
Fixed in 2.18.1, 2.21.1 or 561.va_ce0de3c2d69, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Shared Groovy Libraries Plugin is a component of Jenkins, an open-source automation server. It allows users to define pipelines as code, enabling the creation of continuous integration and delivery workflows. The Shared Groovy Libraries Plugin provides a way to share reusable Groovy code across multiple pipelines. It allows users to define libraries and import them into their pipelines. These libraries can contain functions, classes, and other resources that can be used in pipeline scripts. However, a vulnerability has been discovered in the plugin that allows attackers with the ability to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Vulnerability Detail
The vulnerability in the Jenkins Pipeline: Shared Groovy Libraries Plugin arises from the lack of restrictions on the names of resources passed to the libraryResource step. This allows attackers to specify arbitrary file names and read their contents on the Jenkins controller file system. By exploiting this vulnerability, an attacker with the necessary permissions can access sensitive information, such as configuration files, credentials, or other files stored on the Jenkins controller. This can lead to unauthorized access, data leakage, or other malicious activities.
How To Fix
Latest published version: 636.v3d2c06d018a_6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.18.12.18.1 -
>= 2.19, < 2.21.12.21.1 -
>= 2.22, < 561.va_ce0de3c2d69561.va_ce0de3c2d69
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually restrict access to sensitive files on the Jenkins controller file system. This can be done by adjusting file permissions or moving sensitive files to a restricted directory. However, this workaround may not provide complete protection and should be considered a temporary measure until the plugin is updated to a fixed version.
Conclusion
The Jenkins Pipeline: Shared Groovy Libraries Plugin is vulnerable to an improper limitation of a pathname to a restricted directory vulnerability. This can allow attackers with the ability to configure Pipelines permission to read arbitrary files on the Jenkins controller file system. To mitigate this vulnerability, it is recommended to upgrade to a fixed version of the plugin and review and restrict the permissions of users who can configure Pipelines. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib →
FAQ
This vulnerability allows attackers with the ability to configure Pipelines permission to read arbitrary files on the Jenkins controller file system. This can lead to unauthorized access, data leakage, or other malicious activities.
Users of Jenkins who have the Jenkins Pipeline: Shared Groovy Libraries Plugin installed and have granted the necessary permissions to configure Pipelines are affected by this vulnerability.
There is no known public exploit for this vulnerability at the time of this report. However, it is advisable to apply the recommended fix as soon as possible to mitigate the risk of exploitation.
As a temporary workaround, users can manually restrict access to sensitive files on the Jenkins controller file system. However, this workaround may not provide complete protection and should be considered a temporary measure until the plugin is updated to a fixed version.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-5hfv-mg5x-mv32 or contact the Jenkins community for assistance.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib.
