CVE-2021-21687

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePathuntar...

CVE-2021-21687

CVE-2021-21687 affects Jenkins 2.318 and earlier (incl. LTS 2.303.2 and earlier). It arises from FilePath#untar not checking permission to create symbolic links when unarchiving a symbolic link, enabling improper access control during agent-to-controller file operations. The practical impact is a...