Vulnerability intelligence

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

CVSS Score

4.3

Medium

EPSS — Exploit Probability

0.3%

Riskier than 26% of all CVEs · checked 2026-09-19

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories