Jenkins before version 2.576 and LTS before 2.568.2 does not safely handle symbolic links that have effectively empty names when extracting .tar and .tar.gz archives. An attacker with control over Jenkins agent processes can supply crafted archives that cause the controller to write files to arbitrary locations on the file system. The attack is constrained by the file system permissions of the user running Jenkins, but it can lead to unauthorized file writes. This issue is tracked as CVE-2026-70427 and is associated with CWE-59 (Improper Link Resolution Before File Access).

The vulnerability allows an attacker with limited privileges (control over agent processes) to write files arbitrarily on the Jenkins controller file system. This can lead to integrity issues, such as overwriting or injecting malicious files, but does not directly impact confidentiality or availability. The impact is limited by the file system permissions of the Jenkins user account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict control over Jenkins agent processes to trusted users only to mitigate the risk of exploitation.