CVE-2026-48921

7.5 HIGH

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowin...

Published: 2026-05-27 · Last updated: 2026-05-28

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-59

Affected products

Vendor	Product
jenkins	pipeline\

Description

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-48921
[Vendor advisory]https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3727

Related CVEs

Same vendor

CVE-2026-53442 — Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job c... (5.3 MEDIUM)
CVE-2026-53441 — Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description ... (5.4 MEDIUM)
CVE-2026-53440 — Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" secur... (4.3 MEDIUM)
CVE-2026-53439 — Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine... (4.3 MEDIUM)
CVE-2026-53438 — A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lackin... (4.3 MEDIUM)

Same CWE

CVE-2026-50656 — Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ... (7.8 HIGH)
CVE-2026-54230 — A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport (7.0 HIGH)
CVE-2026-54056 — Kitty is a cross-platform GPU based terminal (7.6 HIGH)
CVE-2026-54055 — Kitty is a cross-platform GPU based terminal (5.0 MEDIUM)
CVE-2025-46293 — This issue was addressed with improved handling of symlinks (5.5 MEDIUM)