CVE-2026-48921
Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
- Record
CVE-2026-48921- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2026-32512
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
- Record
EUVD-2026-32512- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qjq3-wqj5-g37q
Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.
This allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
Pipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.
- Record
GHSA-qjq3-wqj5-g37q- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
- Record
CVE-2026-48921- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
- Record
CVE-2026-48921- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-qjq3-wqj5-g37q
Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.
This allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
Pipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.
- Record
GHSA-qjq3-wqj5-g37q- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.plugins:pipeline-groovy-libMaven |
before 798.v5cc688825312 | 798.v5cc688825312 |
io.jenkins.plugins:pipeline-groovy-libMaven |
before 798.v5cc688825312, plus listed versions 589.vb_a_b_4a_a_8c443c591.v3a_7f422b_d058593.595.vfc6485d13dcd593.va_a_fc25d520e9598.vcd66b_a_336510 Show 27 moreShow less612.614.v48dcb_f62a_640612.v84da_9c54906d613.v9c41a_160233f621.vb_44ce045b_582629.vb_5627b_ee2104656.va_a_ceeb_6ffb_f7671.v07c339c842e8673.vb_c5d5948283c685.v8ee9ed91d574687.v62591d623759689.veec561a_dee13700.v0e341fa_57d53704.vc58b_8890a_384710.v4b_94b_077a_808727.ve832a_9244dfa_730.ve57b_34648c63740.va_2701257fe8d744.v5b_556ee7c253745.vdf6077913de0749.v70084559234a_751.v709f84f7d768752.vdddedf804e72763.v13008816b_de7766.v2b_e08c2e6ff2776.vfee5327b_b_a_5b_787.ve2fef0efdca_6797.v90ea_a_9b_e45a_0 |
798.v5cc688825312 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48921 is a high vulnerability (CVSS 7.5) in Jenkins Project Pipeline: Groovy Libraries Plugin, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in io.jenkins.plugins:pipeline-groovy-lib 798.v5cc688825312.