CVE-2026-33001highCWE-22CWE-59

CVE-2026-33001: falha de alta gravidade em Jenkins

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Jenkins+ Monitorar org.jenkins-ci.main:jenkins-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 2.1%
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Jenkins Project · Jenkins
CVEs relacionadas — Jenkins

No mesmo produto, das mais perigosas para as menos.

CVE-2024-23897CRITICALCVE-2024-23897EPSS 100.0%KEVCVE-2024-23898HIGHCVE-2024-23898EPSS 67.2%CVE-2026-53435HIGHCVE-2026-53435EPSS 53.1%CVE-2024-43044HIGHCVE-2024-43044EPSS 28.8%CVE-2025-59474MEDIUMCVE-2025-59474EPSS 5.0%CVE-2023-43494—CVE-2023-43494EPSS 3.9%