CVE-2026-84667: Vulnerability in Jenkins Project Jenkins ThinBackup Plugin

CVE-2026-84667 affects Jenkins ThinBackup Plugin versions 2.1.4 and earlier. The flaw arises from improper handling of backup configuration through Stapler data binding, which allows an attacker with limited privileges to overwrite the backup configuration. This can be exploited to redirect backup output to attacker-specified directories and to include arbitrary files from the Jenkins controller filesystem in the backup archive. The vulnerability is classified under CWE-22 (Path Traversal). The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality significantly while integrity and availability impacts are lower. No known exploits in the wild or vendor advisories with patch information are currently available.

An attacker with limited privileges on the Jenkins server can manipulate the backup process to write backups to arbitrary directories and include arbitrary files from the Jenkins controller filesystem. This can lead to unauthorized disclosure of sensitive information stored on the Jenkins controller. The integrity impact is limited, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Jenkins ThinBackup Plugin configuration to trusted users only and monitor for suspicious backup configuration changes.