medium4.3
CVE-2025-67643
Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability
Impact
Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkinsci.plugins:pipeline-reporter-by-redpen | <= 1.054 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Redpen - Pipeline Reporter For Jira | through 1.054.v7b_9517b_6b_202 |