HIGH 7.5 Maven
Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries
GHSA-qjq3-wqj5-g37q · CVE-2026-48921
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.
This allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
Pipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.
Ready to move
Start Securing
Free, no credit card | First findings in minutes