CVE-2026-92131 Path traversal in Jenkins Pipeline: Groovy Libraries Plugin
Attackers with Pipeline configuration access can read and delete files on the Jenkins controller via path traversal in the Groovy Libraries Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92131?
CVE-2026-92131 is a medium-severity path traversal vulnerability in Jenkins Pipeline: Groovy Libraries Plugin, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system.
Weakness: CWE-22
Which versions are affected by CVE-2026-92131?
How do I fix CVE-2026-92131?
No fix has been published for CVE-2026-92131 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-92131 being exploited?
There is no known exploitation of CVE-2026-92131 in the wild and no public exploit code.
Sources
Also known as GHSA-8wmw-h5m9-5p5m.