Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-33001 is a high-severity Link Following (CWE-59) vulnerability in Jenkins Jenkins. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 36% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33001 is a file symlink vulnerability (CWE-59) in Jenkins versions 2.554 and earlier, including LTS 2.541.2 and earlier. The issue arises from the software's failure to safely handle symbolic links during the extraction of .tar and .tar.gz archives. This allows crafted archives to write files to arbitrary locations on the filesystem, with access restricted only by the permissions of the user running Jenkins. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-18.
Attackers with Item/Configure permission on a Jenkins item, or those able to control agent processes, can exploit this flaw by supplying malicious .tar or .tar.gz archives. Successful exploitation enables deployment of malicious scripts or plugins directly on the Jenkins controller, potentially leading to full compromise depending on the attacker's goals and the system's configuration.
The official Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657 provides guidance on mitigation, including details on affected versions and recommended patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12843
Vulnerability Data
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access…
more
permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2V15.4.2
Mitigating Controls (NIST 800-53 r5) AI
Proper enforcement of access authorizations on the resolved target resource stops a link from reaching an unintended object.
Input validation directly neutralizes special path elements before pathname construction occurs.
Least-privilege limits the damage an attacker can cause after following an unintended link.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require code to validate paths and avoid unsafe link following.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect link-following flaws before release.
Secure SDLC practices can mandate link-resolution checks and canonicalization before file access.
Application security requirements can explicitly require safe handling of symbolic links and path traversal.
Secure architecture principles include input validation and safe file-access design patterns.
Secure coding standards directly address canonicalization and symlink attacks during implementation.
Information access restriction limits which files an application may read or write.