CVE-2026-70428 is a vulnerability in Jenkins that affects versions 2.575 and earlier, and LTS 2.568.1 and earlier. The issue arises because Jenkins improperly identifies file paths when processing file parameter names, enabling attackers with specific permissions (Item/Configure and Item/Build) to perform path traversal attacks. This allows them to write files to arbitrary locations on the controller's file system, potentially leading to unauthorized file modifications or code execution depending on the environment and usage.

Attackers with Item/Configure and Item/Build permissions can write files to arbitrary locations on the Jenkins controller file system. This could lead to unauthorized file manipulation, potentially compromising the integrity and security of the Jenkins server. The impact depends on the permissions of the attacker and the environment but could be significant in environments where these permissions are granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Item/Configure and Item/Build permissions to trusted users only to reduce the risk of exploitation.