CVE-2026-19429

CVE-2026-19429 affects Jenkins FilePath.untarFrom() across all versions, including those with the CVE-2026-33001 patch. The root cause is that while symlink destinations are validated, the symlink targets are not; the target path (returned by te.getLinkName()) is passed directly to symlinkTo() an...