CVE-2026-33001 affects Jenkins versions up to 2.554 and LTS 2.541.2 and earlier. The vulnerability arises from unsafe handling of symbolic links during extraction of .tar and .tar.gz archives, enabling crafted archives to write files arbitrarily on the filesystem within the permissions of the Jenkins process user. This can be exploited by attackers with Item/Configure permission or control over agent processes to deploy malicious scripts or plugins on the Jenkins controller. The vulnerability is categorized under CWE-59 (Link Following) and CWE-22 (Path Traversal). Red Hat has published multiple advisories and errata addressing this issue, including updates for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12. Users are advised to upgrade to the latest patched versions as per Red Hat advisories.

Successful exploitation allows attackers with limited Jenkins permissions (Item/Configure or agent control) to write arbitrary files on the Jenkins controller filesystem. This can lead to deployment of malicious scripts or plugins, potentially compromising confidentiality, integrity, and availability of the Jenkins environment. The impact is high as indicated by the CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, required privileges, and high impact on confidentiality, integrity, and availability.

Red Hat has released security updates for affected products, including OpenShift Jenkins 4.12, which address CVE-2026-33001. It is recommended that users upgrade to the latest available versions as per Red Hat advisories linked in the vendor advisory content. Since this is a vulnerability in self-hosted Jenkins instances, patching the Jenkins installation to a fixed version is the primary mitigation. No vendor advisory indicates that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by Red Hat advisories; users should consult these for exact fixed versions and update instructions.