HIGH 7.5 Maven

Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries

GHSA-qjq3-wqj5-g37q · CVE-2026-48921

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Description

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.

This allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

Pipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.

Ready to move

Start Securing

Free, no credit card | First findings in minutes