CVE-2025-67643: Path Traversal Vulnerability in Jenkins Redpen - Pipeline Reporter for Jira Plugin
Summary
CVE-2025-67643: Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability. Affects org.jenkinsci.plugins:pipeline-reporter-by-redpen versions < 1.054. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Redpen - Pipeline Reporter for Jira Plugin is designed to facilitate the integration of Jenkins with Jira, allowing users to report pipeline results directly to their Jira projects. This plugin enhances the CI/CD workflow by providing visibility into build statuses and results. However, it has been identified to have a critical security flaw that could expose sensitive files on the Jenkins controller.
Vulnerability Detail
The vulnerability arises from improper path validation when uploading artifacts to Jira. Specifically, versions 1.054.v7b_9517b_6b_202 and earlier fail to restrict access to the workspace directory. Attackers with Item/Configure permissions can exploit this flaw to access and retrieve files stored in the Jenkins controller's workspace, potentially leading to unauthorized data exposure and compromise of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict the permissions of users who have Item/Configure access to prevent them from exploiting this vulnerability until a patch is applied.
Conclusion
The Jenkins Redpen - Pipeline Reporter for Jira Plugin has a significant path traversal vulnerability that could expose sensitive files. It is crucial for users to update to the latest version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for org.jenkinsci.plugins:pipeline-reporter-by-redpen →
FAQ
It is a path traversal vulnerability that allows unauthorized access to files in the Jenkins workspace.
Any Jenkins instance using the affected versions of the Redpen - Pipeline Reporter for Jira Plugin is at risk.
Attackers could access sensitive files, leading to data breaches and potential exploitation of the Jenkins environment.
You can use Vulert's playground at Vulert Scanner to monitor and check for vulnerabilities without needing to sign up.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
