CVE-2026-19429

CVE-2026-19429 affects Jenkins Project Jenkins through LTS 2.555.3. An incomplete patch for CVE-2026-33001 leaves a symlink target validation bypass during tar extraction in FilePath.java. An authenticated user with Item/Configure permission can craft a tar archive to cause a symlink inside the w...