A critical path traversal flaw in the Jenkins File Parameter Plugin allows attackers with specific permissions to write arbitrary files to the controller, risking remote code execution.

The plugin allows for arbitrary file writes on the Jenkins controller file system through improper Stapler data binding. This flaw enables an authenticated attacker to manipulate file paths, which can be leveraged to achieve remote code execution.

The ability to write arbitrary files to the Jenkins controller is a severe security failure. With a CVSS score of 8.8, this vulnerability allows an attacker to gain full control over the CI/CD pipeline, potentially poisoning build artifacts or stealing sensitive credentials, which could lead to a compromise of the broader development environment.

Immediate Action: Update the Jenkins File Parameter Plugin to a version greater than 425.v3fa_801681b_5e.

Proactive Monitoring: Monitor Jenkins controller filesystem access logs for suspicious file creation events in unexpected directories.

Compensating Controls: Restrict access to Jenkins project configuration and parameter settings to only trusted users to limit the potential attack surface.

Public Exploit Available: No

Jenkins administrators should treat this vulnerability with high urgency. Applying the vendor-provided security update is the only effective way to prevent the risk of unauthorized file writes and potential remote code execution.