CVE-2026-19429

Jenkins FilePath.untarFrom all versions validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access can trigger extraction of a malicious tar via POST /job/name/build, planting symlinks to secrets/master.key, secrets/hudson.util.Secret, and...