{"id":"CVE-2026-117626","title":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain th…","summary":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain th…","severity":"none","vendor":"Jenkins Project","product":"Jenkins","affected":["Jenkins (all versions)"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:48:37.200Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117626","references":[{"url":"https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4237","label":"Jenkins Security Advisory 2026-10-28"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T17:14:44.446Z","epss":0.0017,"epssPercentile":0.06457,"slug":"CVE-2026-117626","body":"## Overview\n\nJenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.\n\n## Affected\n\n- `Jenkins (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}