{"id":"CVE-2026-48921","aliases":["EUVD-2026-32512","GHSA-qjq3-wqj5-g37q"],"status":"published","title":"Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries","description":"Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00289,"percentile":0.21765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-05-27T14:13:49Z","modified":"2026-10-24T14:39:15Z","fixes":[{"ecosystem":"Maven","package":"io.jenkins.plugins:pipeline-groovy-lib","fixed_in":["798.v5cc688825312"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.jenkins.plugins:pipeline-groovy-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"798.v5cc688825312"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.jenkins.plugins:pipeline-groovy-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"798.v5cc688825312"}]}],"versions":["589.vb_a_b_4a_a_8c443c","591.v3a_7f422b_d058","593.595.vfc6485d13dcd","593.va_a_fc25d520e9","598.vcd66b_a_336510","612.614.v48dcb_f62a_640","612.v84da_9c54906d","613.v9c41a_160233f","621.vb_44ce045b_582","629.vb_5627b_ee2104","656.va_a_ceeb_6ffb_f7","671.v07c339c842e8","673.vb_c5d5948283c","685.v8ee9ed91d574","687.v62591d623759","689.veec561a_dee13","700.v0e341fa_57d53","704.vc58b_8890a_384","710.v4b_94b_077a_808","727.ve832a_9244dfa_","730.ve57b_34648c63","740.va_2701257fe8d","744.v5b_556ee7c253","745.vdf6077913de0","749.v70084559234a_","751.v709f84f7d768","752.vdddedf804e72","763.v13008816b_de7","766.v2b_e08c2e6ff2","776.vfee5327b_b_a_5b_","787.ve2fef0efdca_6","797.v90ea_a_9b_e45a_0"]}],"products":[{"vendor":"jenkins","product":"pipeline\\"},{"vendor":"jenkins project","product":"jenkins pipeline: groovy libraries plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3727","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48921","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qjq3-wqj5-g37q"},{"url":"https://github.com/jenkinsci/pipeline-groovy-lib-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48921","description":"Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.","status":"published","published":"2026-05-27T14:13:49.193Z","modified":"2026-05-27T18:35:27.63Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-32512","description":"Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.","status":"published","published":"2026-05-27T14:13:49Z","modified":"2026-05-27T18:35:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:21:03.450999Z"}],"ghsa":[{"id":"GHSA-qjq3-wqj5-g37q","title":"Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries","description":"Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.\n\nThis allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.\n\nPipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.","status":"published","published":"2026-05-27T15:33:26Z","modified":"2026-07-01T19:26:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:40:36.577366Z"}],"nvd":[{"id":"CVE-2026-48921","description":"Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.","status":"published","published":"2026-05-27T15:16:31.747Z","modified":"2026-10-14T20:10:00.19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:20.885865Z"}],"osv":[{"id":"CVE-2026-48921","description":"Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.","status":"published","published":"2026-05-27T15:16:31.747Z","modified":"2026-10-24T14:39:15.458044472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"GHSA-qjq3-wqj5-g37q","title":"Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries","description":"Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.\n\nThis allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.\n\nPipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.","status":"published","published":"2026-05-27T15:33:26Z","modified":"2026-07-01T19:41:29.145055Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}