~ / search / GHSA-qxh4-j39m-qfx4

GHSA-qxh4-j39m-qfx4

Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-67643

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkinsci.plugins:pipeline-reporter-by-redpen <= 1.054 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

References

External links from the advisory. They lead to third-party sites.