GHSA-g2pq-9jr7-w6gv

Jenkins Git client Plugin file system information disclosure vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-58458

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:git-client	< 6.3.3	6.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

In Jenkins Git client Plugin 6.3.2 and earlier, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-58458 advisory
https://github.com/jenkinsci/git-client-plugin/commit/20090a86c3ebc72e5283c882de73e3a4459137bb web
https://github.com/jenkinsci/git-client-plugin package
https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3590 web
http://www.openwall.com/lists/oss-security/2025/09/03/4 web