What’s Vulnerable › Vulnerabilities

CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-08-19
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-24 · updated 2026-06-17
• Weakness: CWE-22

Description

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Summary

Jenkins 2.441 and earlier, and LTS 2.426.2 and earlier, fail to disable a CLI parser feature that expands '@' followed by a file path into the file's contents, letting unauthenticated attackers read arbitrary files on the controller (CVSS 9.8). This is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit exists, and EPSS estimates a 100% chance of exploitation in 30 days. Upgrade to Jenkins 2.442 or LTS 2.426.3; if you cannot patch immediately, apply the vendor's mitigations or discontinue use of the product.

تسمح ثغرة في Jenkins 2.441 والإصدارات الأقدم، وLTS 2.426.2 والإصدارات الأقدم، لمهاجمين غير مصادق عليهم بقراءة ملفات عشوائية على نظام ملفات متحكم Jenkins، لأن ميزة في محلل أوامر CLI تستبدل '@' متبوعًا بمسار ملف بمحتوى الملف ولا تُعطَّل (CVSS 9.8). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال مع استغلال نشط، ويتوفر استغلال عام، وتقدّر EPSS احتمال الاستغلال خلال 30 يومًا بنسبة 100%. يجب الترقية إلى Jenkins 2.442 أو LTS 2.426.3، وفي حال تعذّر الترقية الفوري يُطبَّق تخفيف وفق تعليمات المورّد أو يُوقف استخدام المنتج.

Affected products

• Jenkins: before 2.426.3; before 2.442 — fixed in 2.426.3, 2.442

How to fix

Upgrade to a fixed version: Jenkins 2.426.3, 2.442. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html
• http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html
• http://www.openwall.com/lists/oss-security/2024/01/24/6
• https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
• https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
• http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html
• http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html
• http://www.openwall.com/lists/oss-security/2024/01/24/6
• https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
• https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
• https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897

Get alerted when CVE-2024-23897 or the next vulnerability affects your stack