CVE-2026-19429

CVE-2026-19429 affects Jenkins FilePath.untarFrom() across all versions. Two independent symlink issues allow arbitrary file read: (1) the symlink target is not validated, enabling reads of controller filesystem paths; and (2) a Unicode zero-width character bypass lets an archive entry named with...