CVE-2025-58458: Jenkins Git Client Plugin File System Information Disclosure Vulnerability
Summary
CVE-2025-58458: Jenkins Git client Plugin file system information disclosure vulnerability. Affects org.jenkins-ci.plugins:git-client versions < 6.3.3. Fixed in 6.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Client Plugin is a widely used plugin in Jenkins, a popular open-source automation server. This plugin facilitates the integration of Git version control into Jenkins jobs, allowing users to clone repositories, manage branches, and perform various Git operations seamlessly. However, certain versions of this plugin are susceptible to a vulnerability that can lead to unauthorized file system information disclosure.
Vulnerability Detail
In Jenkins Git Client Plugin versions 6.3.2 and earlier, there exists a vulnerability related to the validation of the Git URL field when using the 'amazon-s3' protocol with JGit. The responses from the form validation differ based on whether the specified file path exists on the Jenkins controller. This inconsistency allows attackers with Overall/Read permission to determine the existence of specific file paths on the Jenkins controller's file system, potentially exposing sensitive information.
How To Fix
Minimum fixed version
6.3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict Overall/Read permissions for users who should not have access to sensitive file system information. This can be done by adjusting the user permissions in Jenkins settings.
Conclusion
The Jenkins Git Client Plugin has a vulnerability that can lead to unauthorized access to file system information. It is crucial to update to version 6.3.3 or later to mitigate this risk. Additionally, users should consider adjusting permissions as a temporary workaround until the update can be applied.
See every vulnerability recorded for org.jenkins-ci.plugins:git-client →
FAQ
CVE-2025-58458 is a vulnerability in the Jenkins Git Client Plugin that allows attackers to disclose file system information based on Git URL validation responses.
Versions 6.3.2 and earlier of the Jenkins Git Client Plugin are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can alert you to any vulnerabilities, including CVE-2025-58458.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
If immediate updates are not possible, consider restricting user permissions to mitigate the risk of information disclosure.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git-client.
