high7.5
CVE-2026-48921
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to co…
Impact
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:pipeline-groovy-lib | < 798.v5cc688825312 | 798.v5cc688825312 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Pipeline\ | before 798.v5cc688825312 |