CVE-2026-19429 Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass (Arbitrary File Read)

Jenkins FilePath.untarFrom in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by...