A high-severity path traversal vulnerability in Jenkins allows authenticated attackers to perform arbitrary file writes, potentially leading to full system compromise.

The vulnerability exists in the handling of .tar and .tar.gz archives, where improper symbolic link validation enables arbitrary file writes. Attackers with Item/Configure permissions or control over agent processes can leverage this to deploy malicious scripts or plugins.

Successful exploitation allows an attacker to write files to arbitrary locations on the Jenkins controller, restricted only by the permissions of the Jenkins service user. Given the CVSS score of 8.8, this poses a significant risk of remote code execution, unauthorized data access, and full system takeover, which could lead to severe operational disruption and the compromise of sensitive build pipelines.

Immediate Action: Update the Jenkins core to version 2.555 or newer, or upgrade to the latest supported LTS release (2.541.3 or later) to resolve the underlying archive extraction flaw.

Proactive Monitoring: Review Jenkins access logs for unusual Item/Configure activity and monitor the filesystem for unexpected file creation or modification events within the Jenkins workspace.

Compensating Controls: Restrict access to the Item/Configure permission to trusted users only and implement strict filesystem-level permissions for the service account running the Jenkins process to limit the impact of potential writes.

Public Exploit Available: exploit_available (unknown)

This vulnerability represents a critical risk to the integrity of the CI/CD pipeline and the underlying host infrastructure. Security teams should prioritize patching Jenkins to the specified fixed versions immediately to prevent authenticated attackers from escalating their privileges to full system control.