CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2026-57296

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.

CVSS Score
8.8
High
EPSS — Exploit Probability
0.6%
Riskier than 45% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
NVD entry PoC / advisory

1 article across 1 outlet · first covered Jun 25, 2026 · latest Jun 25, 2026

Coverage timeline