Sign in
Deutsch English Español Polski
High

Jenkins Credentials Binding Plugin has a path traversal vulnerability

  • Disclosed: 29.04.2026
  • Updated: 11.10.2026 12:22

Jenkins Credentials Binding Plugin versions 719.v80e905ef14eb_ and earlier do not sanitize file names for file and zip file credentials.

This allows attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem. If Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node, this can lead to remote code execution.

Credentials Binding Plugin 720.v3f6decef43ea_ sanitizes the file name provided for file and zip file credentials, preventing path traversal.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.jenkins-ci.plugins:credentials-binding < 720.v3f6decef43ea 720.v3f6decef43ea

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-22
Platform
Java / Kotlin (Maven)
Package
org.jenkins-ci.plugins:credentials-binding
Disclosed
29.04.2026
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-p2rf-wpxj-mx2g - CC BY 4.0

Vulnerability history: org.jenkins-ci.plugins:credentials-binding

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
8
First → latest
01.2022 05.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • High 2
  • Medium 5
  • Low 1

Disclosures per year

  1. Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials
    High · 7.5 CVE-2026-48922 < 725.ve52b 725.ve52b
  2. Jenkins Credentials Binding Plugin has a path traversal vulnerability this entry
    High · 7.5 CVE-2026-42520 < 720.v3f6decef43ea 720.v3f6decef43ea
  3. Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages
    Medium · 4.3 CVE-2025-53650 < 687.689.v1a 687.689.v1a
  4. Improper masking of some secrets in Jenkins Credentials Binding Plugin
    Low · 3.1 CVE-2020-2182 < 1.23 1.23
  5. Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps
    Medium · 5.3 CVE-2020-2181 < 1.23 1.23
  6. Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format
    Medium · 6.5 CVE-2019-1010241 = 1.17 no fix
  7. Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
    Medium · 4.3 CVE-2018-1000057 < 1.15 1.15
  8. Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin
    Medium · 4.3 CVE-2022-20616 >= 1.25, < 1.27.1, < 1.24.1 1.27.1, 1.24.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.