CVE-2026-19429

Jenkins FilePath.untarFrom in all versions, including those with the CVE-2026-33001 and CVE-2026-70427 patches applied, contains two distinct symlink validation weaknesses that independently allow arbitrary file read. 1. SYMLINK TARGET NOT VALIDATED all versions: The CVE-2026-33001 fix enforces...