CVE-2026-57296
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile — higher than 44% of all known CVEs
Summary
Jenkins External Workspace Manager Plugin version 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system.
Risk Assessment
Attackers may gain access to sensitive data or execute remote code, posing a serious security threat to the Jenkins system.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and restrict Item/Configure permissions to trusted users only.
Original NVD description (English source)
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.