GHSA-P2RF-WPXJ-MX2G Jenkins Credentials Binding Plugin has a path traversal vulnerability

Jenkins Credentials Binding Plugin versions 719.v80e905ef14eb and earlier do not sanitize file names for file and zip file credentials. This allows attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem. If Jenkins is configured to allow a...

io.jenkins.plugins:docker-slaves (259.v43582a_63e8b_9), org.jenkins-ci.plugins:azure-keyvault (359.v675a_5ee82d51) +3 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (717.v951d49b_5f3a_a)

org.jenkins-ci.plugins:credentials-binding MAVEN version 717.v951d49b5f3aa is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:docker-slaves 259.v43582a63e8b9 -...

CVE-2026-42520

Jenkins Credentials Binding Plugin 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins...

CVE-2026-42520

Jenkins Credentials Binding Plugin 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins...

EUVD-2026-26221

Jenkins Credentials Binding Plugin 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins...

CVE-2026-42520

Jenkins Credentials Binding Plugin 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins...

CVE-2026-42520

Jenkins Credentials Binding Plugin 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins...

CVE-2026-42520

Jenkins Credentials Binding Plugin 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins...

PT-2026-35914

Name of the Vulnerable Software and Affected Versions Jenkins Credentials Binding Plugin versions prior to 719.v80e905ef14eb Description Insufficient sanitization of file names for file and zip file credentials allows attackers who can provide credentials to a job to write files to arbitrary...

Jenkins Credentials Binding Plugin 路径遍历漏洞

The Jenkins Credentials Binding Plugin is an open-source plugin developed by Jenkins that binds secure credentials stored in Jenkins to environment variables during build processes. The Jenkins Credentials Binding Plugin versions 719.v80e905ef14eb and earlier have a path traversal vulnerability...

CVE-2026-42520: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Credentials Binding Plugin 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins...

Path traversal vulnerability in credentials-binding

credentials-binding 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials. This allows attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem. If Jenkins is configured to allow a low-privileged user to...

Jenkins plugins Multiple Vulnerabilities (2026-04-29)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - High HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file. This results in a stored cross-site...

EUVD-2022-2282

Malicious code in bioql PyPI...

EUVD-2022-0609

Malicious code in bioql PyPI...

EUVD-2025-20864

Malicious code in bioql PyPI...

Logging of Excessive Data

Overview org.jenkins-ci.plugins:credentials-binding is a plugin that allows credentials to be bound to environment variables for use from miscellaneous build steps. Affected versions of this package are vulnerable to Logging of Excessive Data via exception messages written to the build log. An...

Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages

Jenkins Credentials Binding Plugin 687.v619cb15e923f and earlier does not properly mask i.e., replace with asterisks credentials present in exception error messages that are written to the build log. Credentials Binding Plugin 687.689.v1af775332fc9 rethrows exceptions that contain credentials,...

com.nirima:docker-plugin (>=0.17, <=1.0.4), io.fabric8.jenkins.plugins:openshift-sync (>=1.0.43, <=1.0.45) +2 more potentially affected by CVE-2025-53650 via org.jenkins-ci.plugins:credentials-binding (1.12)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.nirima:docker-plugin =0.17, =1.0.43, =1.7, =0.1.5, =0.2.0 Source cves:...

io.jenkins.plugins:aws-sam (>=1.2.7, <=1.2.13), org.jenkins-ci.plugins:azure-dev-spaces (>=3.0.0, <=3.0.3) +2 more potentially affected by CVE-2025-53650 via org.jenkins-ci.plugins:credentials-binding (1.16)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:aws-sam =1.2.7, =3.0.0, =0.2.1, =2.0.13, =2.0.15 Source...