Threats tagged 'ghsa-p6wg-qjmq-cvgh'

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability in how symbolic links are checked during file extraction. The system only checks for symbolic links in the path before creating parent directories, not immediately before writing the file. This flaw allows attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system by exploiting symbolic links in artifacts.