A critical vulnerability in the Jenkins Robot Framework Plugin allows authenticated attackers to execute arbitrary code on the Jenkins controller by exploiting insufficient path validation.

The plugin fails to ensure that the archive directory for report files remains within the designated build directory. This flaw permits an attacker with Item/Configure permissions to write or overwrite arbitrary files on the Jenkins controller file system.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the Jenkins controller, which typically serves as a central hub for CI/CD pipelines. Given the CVSS score of 8.8, this poses a high risk of full system compromise, potential lateral movement into development environments, and unauthorized access to sensitive source code or deployment credentials.

Immediate Action: Review the official Jenkins security advisory for the latest plugin version and update the Robot Framework Plugin immediately to the version containing the security fix.

Proactive Monitoring: Audit Jenkins audit logs for unusual configuration changes to job settings or unexpected file system modifications originating from the Jenkins service account.

Compensating Controls: Restrict Item/Configure permissions to only the most trusted administrative users to minimize the attack surface until the patch is applied.

Public Exploit Available: No confirmed public exploit exists in the provided data.

This vulnerability represents a significant security risk to the integrity of the CI/CD pipeline. Administrators should prioritize updating the Jenkins Robot Framework Plugin as soon as a patched version is available. Limiting administrative access to job configurations is a vital interim step to prevent exploitation by malicious or compromised internal accounts.