A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in `core/src/main/java/hudson/model/FileParameterValue.java` allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.

Affected Packages

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 0 (fixed in 2.176.2)

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 2.177 (fixed in 2.186)

Related CVEs

CVE-2019-10352

Key Information

GHSA ID

GHSA-qr42-82qj-mw65

Published

May 24, 2022 4:50 PM

Last Modified

March 12, 2024 3:58 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.main:jenkins-core

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.