CVE-2026-92131 Jenkins Project CVE debrief

Who should care

Jenkins administrators and users who configure Pipelines should assess exposure to CVE-2026-92131 and verify remediation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-92131 is a path traversal vulnerability in Jenkins Pipeline: Groovy Libraries Plugin that allows attackers to read and delete files on the Jenkins controller file system. Jenkins administrators and users who configure Pipelines should assess exposure and verify remediation.

• Read files in a resources directory on the Jenkins controller file system
• Delete files in a test directory on the Jenkins controller file system
• Verify plugin version and apply remediation if available
• Monitor Jenkins controller file system for unauthorized access

Technical summary

CVE-2026-92131 is a path traversal vulnerability in Jenkins Pipeline: Groovy Libraries Plugin. The plugin does not restrict library paths to relative paths inside the SCM checkout and follows symbolic links to locations outside the SCM checkout. This allows attackers able to configure Pipelines to read files in a resources directory and delete files in a test directory on the Jenkins controller file system.

Defensive priority

Assess exposure and verify remediation for Jenkins Pipeline: Groovy Libraries Plugin.

Recommended defensive actions

• Assess exposure to CVE-2026-92131 in Jenkins Pipeline: Groovy Libraries Plugin
• Verify plugin version and apply remediation if available
• Monitor Jenkins controller file system for unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the path traversal vulnerability in Jenkins Pipeline: Groovy Libraries Plugin. The CVE record was published on 2026-09-16T14:17:15.113Z and has not been modified since then. The vulnerability allows attackers able to configure Pipelines to read files in a resources directory and delete files in a test directory on the Jenkins controller file system.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.