The Jenkins Credentials Binding Plugin before version 720.v3f6decef43ea_ improperly sanitizes file names associated with file and zip file credentials. This flaw enables attackers with the ability to supply credentials to a Jenkins job to write files arbitrarily on the node's filesystem. If Jenkins permits low-privileged users to configure these credentials for jobs on the built-in node, this vulnerability can be exploited to achieve remote code execution. The vulnerability was published on 2026-05-27, but no CVSS score or remediation level has been provided yet.

An attacker able to provide credentials to a Jenkins job can write files to arbitrary locations on the node filesystem, potentially leading to remote code execution. This risk is contingent on Jenkins being configured to allow low-privileged users to configure file or zip file credentials for jobs running on the built-in node. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Jenkins Project vendor advisory for current remediation guidance. Until an official fix is released, restrict the ability of low-privileged users to configure file or zip file credentials in Jenkins jobs, especially on the built-in node, to reduce the risk of exploitation.