CVE-2025-67643

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-10 · updated 2026-10-14
Weakness: CWE-22

Description

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

Affected products

Jenkins Project Jenkins Redpen - Pipeline Reporter for Jira Plugin: through 1.054.v7b_9517b_6b_202

References

https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3290

Get alerted when CVE-2025-67643 or the next vulnerability affects your stack