CVE-2023-46655 Jenkins CloudBees CD Plugin vulnerable to arbitrary file read

Medium 6.5 Published 25 Oct 2023 Updated 13 Feb 2025

Attackers with job configuration access can publish arbitrary files from the Jenkins controller to CloudBees CD via symbolic link traversal.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-46655?

CVE-2023-46655 is a medium-severity path traversal vulnerability in Jenkins CloudBees CD Plugin, published on 25 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server.

Weakness: CWE-59

Which versions are affected by CVE-2023-46655?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:electricflow. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:electricflow` Maven	All versions	`1.1.33`
`org.jenkins-ci.plugins:electricflow` Maven	All versions	`1.1.33`

Products include Jenkins Cloudbees Cd.

How do I fix CVE-2023-46655?

Upgrade org.jenkins-ci.plugins:electricflow to 1.1.33 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-46655 being exploited?

There is no known exploitation of CVE-2023-46655 in the wild and no public exploit code.

Sources

Also known as GHSA-9ggw-h9mf-4jh7.