{"id":"CVE-2026-117615","title":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins contr…","summary":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins contr…","severity":"none","vendor":"Jenkins Project","product":"Jenkins","affected":["Jenkins (all versions)"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:48:30.831Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117615","references":[{"url":"https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4187","label":"Jenkins Security Advisory 2026-10-28"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T17:14:44.452Z","slug":"CVE-2026-117615","body":"## Overview\n\nJenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.\n\n## Affected\n\n- `Jenkins (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}