CVE-2026-19429 Jenkins Project Jenkins - Symlink Target Validation Bypass Arbitrary File Read

Jenkins FilePath.untarFrom all versions validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers tar extraction via POST /job/name/build, writing persistent symlinks into the tool cache. Symlinks to secrets/master.key, hudson.util.Secret,...