VDB
BIT-jenkins-2026-33001
BIT-jenkins-2026-33001
PUBLISHED
CVSS 8.800000190734863 HIGH
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | jenkins | 0, 2.542.0, 0 |
Timeline
- Mar 20, 2026 CVE Published
- Jul 6, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-33001 url
- https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657 url
- https://access.redhat.com/errata/RHSA-2026:10199 url
- https://access.redhat.com/errata/RHSA-2026:10201 url
- https://access.redhat.com/errata/RHSA-2026:10204 url
- https://access.redhat.com/errata/RHSA-2026:10205 url
- https://access.redhat.com/errata/RHSA-2026:10206 url
- https://access.redhat.com/errata/RHSA-2026:10209 url
- https://access.redhat.com/errata/RHSA-2026:10211 url
- https://access.redhat.com/errata/RHSA-2026:10213 url
- https://access.redhat.com/errata/RHSA-2026:10214 url
- https://access.redhat.com/errata/RHSA-2026:10215 url
- https://access.redhat.com/security/cve/CVE-2026-33001 url
- https://bugzilla.redhat.com/show_bug.cgi?id=2448645 url
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33001.json url