CVE-2026-84671

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-03
Weakness: CWE-22

Description

Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.

Affected products

Jenkins Project Jenkins File Parameter Plugin: through 425.v3fa_801681b_5e

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4093

Get alerted when CVE-2026-84671 or the next vulnerability affects your stack