Jenkins Pipeline: Groovy Libraries Plugin versions up to 805.va_fc79344957d are affected by a path traversal vulnerability. The plugin fails to restrict the library path provided to the library Pipeline step to a relative path within the SCM checkout directory. It also follows symbolic links that can point outside the SCM checkout, enabling attackers who can configure pipelines to read files from a resources directory and delete files in a test directory on the Jenkins controller's filesystem.

An attacker with the ability to configure Jenkins pipelines can exploit this vulnerability to read arbitrary files in a resources directory and delete files in a test directory on the Jenkins controller. This could lead to unauthorized data disclosure and potential disruption of Jenkins operations by deleting files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict pipeline configuration permissions to trusted users only to reduce the risk of exploitation.