CVE-2026-19429

creationtimestamp| type| source ---|---|--- 2026-08-10 15:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqgt4gzcu2u 2026-08-10 23:53:23+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3msrcbmtv622n...

io.jenkins.plugins:design-library (444.v568b_174ece88), io.jenkins.plugins:login-theme (339.v8f0b_a_5695303) +1 more potentially affected by CVE-2026-19429 +1 more via org.jenkins-ci.main:jenkins-core (>=2.569, <=2.574)

org.jenkins-ci.main:jenkins-core MAVEN version =2.569, =2.569, =2.574 Source cves: CVE-2026-19429, CVE-2026-33001 Source advisory: SNYK:JAVA-ORGJENKINSCIMAIN-18609775...

CVE-2026-19429

CVE-2026-19429 relates to Jenkins FilePath.untarFrom() where TAR extraction does not validate tar entry symlink targets, allowing an authenticated user with Item/Configure privileges to create workspace symlinks that point to arbitrary files on the Jenkins controller. This can enable reading sens...

CVE-2026-19429

...