CVE-2022-30949: Path traversal in Jenkins REPO Plugin
Summary
CVE-2022-30949: Path traversal in Jenkins REPO Plugin. Affects org.jenkins-ci.plugins:repo versions < 1.14.1. Fixed in 1.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins REPO Plugin is a Maven ecosystem package that provides support for Source Code Management (SCM) in Jenkins. It allows users to configure pipelines to check out SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs. This plugin is commonly used in Jenkins environments to manage and automate software builds.
Vulnerability Detail
The vulnerability identified as CVE-2022-30949 is a path traversal vulnerability in the Jenkins REPO Plugin. SCMs in Jenkins support various URL schemes, including local file system paths. Historically, only agents checked out from SCM, and there was no expected isolation between builds unless overridden. However, some Pipeline-related features check out SCMs from the Jenkins controller as well. Attackers with the ability to configure pipelines can exploit this vulnerability to check out SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs. This allows them to obtain limited information about other projects' SCM contents, potentially leading to unauthorized access and data leakage.
How To Fix
Latest published version: 1.17.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.14.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by ensuring that only trusted individuals have the ability to configure pipelines and access sensitive SCM repositories. Additionally, it is important to regularly monitor and review SCM contents for any unauthorized access or modifications.
Conclusion
The path traversal vulnerability in the Jenkins REPO Plugin (CVE-2022-30949) allows attackers to access limited information about other projects' SCM contents. To mitigate this risk, it is crucial to upgrade the plugin to version 1.14.1 or later. Regular monitoring and review of SCM contents are also recommended to detect any unauthorized access or modifications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:repo →
FAQ
The vulnerability allows attackers to access limited information about other projects' SCM contents stored on the Jenkins controller's file system. This can potentially lead to unauthorized access, data leakage, and compromise of sensitive information.
Users of Jenkins REPO Plugin versions prior to 1.14.1 are affected by this vulnerability. Organizations using Jenkins with the REPO Plugin should ensure they are running the latest version to mitigate the risk.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to prevent potential exploitation.
No, this vulnerability requires the ability to configure pipelines in Jenkins. Remote exploitation is not possible without prior access to the Jenkins environment.
For more information about this vulnerability, including technical details and the fix implemented in version 1.14.1 of the Jenkins REPO Plugin, refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8vfc-fcr2-47pj/GHSA-8vfc-fcr2-47pj.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:repo.
