CVE-2026-57296

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

8.8 HighFix available

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.83%Up 0.2 points since Jun 25, 2026

What each source reports

CVE List Score used 8.8

Record: CVE-2026-57296
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2026-38777 8.8

Record: EUVD-2026-38777
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hrmj-8fm9-cg8x 8.8

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject .. path segments when validating the custom workspace path provided to the exwsAllocate Pipeline step, allowing the resulting workspace path to escape the configured disk mount point.

This allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution (see Reading Files).

External Workspace Manager Plugin 1.4.0 rejects .. path segments when validating the custom workspace path, and additionally verifies that the requested path is contained within the configured disk mount point before serving it through the external workspace browse functionality.

Record: GHSA-hrmj-8fm9-cg8x
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

NVD 8.8

Record: CVE-2026-57296
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSVGHSA-hrmj-8fm9-cg8x 8.8

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

This allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution (see Reading Files).

Record: GHSA-hrmj-8fm9-cg8x
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

Affected products

jenkins project external workspace manager plugin

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:external-workspace-manager` Maven	before 1.4.0	1.4.0
`org.jenkins-ci.plugins:external-workspace-manager` Maven	before 1.4.0, plus listed versions 1.0-alpha-11.0-beta-11.0.01.1.01.1.1 Show 8 moreShow less 1.1.21.2.01.2.11.2.21.2.31.3.01.3.11.3.2	1.4.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57296 is a high vulnerability (CVSS 8.8) in Jenkins Project External Workspace Manager Plugin, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 58th percentile. Fixed in org.jenkins-ci.plugins:external-workspace-manager 1.4.0.