jenkins: File path filters do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories

🗓️ 01 Dec 2021 12:28:59Reported by RedHatType

Jenkins vulnerability where file path filters do not canonicalize paths, allowing symbolic link traversal to disallowed directories and potential read and write of files on the controller filesystem.

Reporter	Title	Published	Views	Family All 48
FreeBSD	jenkins -- multiple vulnerabilities	4 Nov 202100:00	–	freebsd
AlpineLinux	CVE-2021-21686	4 Nov 202117:15	–	alpinelinux
ArchLinux	[ASA-202111-1] jenkins: multiple issues	5 Nov 202100:00	–	archlinux
BDU FSTEC	The vulnerability of the agent-to-controller subsystem of the Jenkins automation server allows a attacker to compromise the confidentiality and integrity of the protected information.	16 Dec 202100:00	–	bdu_fstec
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.277.43.0.2 / 2.303.3.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-11-04)	19 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (2bf56269-90f8-4a82-b82f-c0e289f2a0dc)	5 Nov 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.303.3 / Jenkins weekly < 2.319 Multiple Vulnerabilities	4 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.6.51 (RHSA-2021:4799)	3 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.38 (RHSA-2021:4801)	2 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 7 : OpenShift Container Platform 3.11.569 (RHSA-2021:4827)	4 Dec 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins	2.303.3.1637597018-1.el8	jenkins-2.303.3.1637597018-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-21686
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21686
cve	www.cve.org/CVERecord
jenkins	www.jenkins.io/security/advisory/2021-11-04/

21 Mar 2026 05:05Current

5.9Medium risk

Vulners AI Score5.9

CVSS 25.8

CVSS 3.18.1

EPSS0.01911

CWE-59