-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated filename handling in Stashed File Parameters. The commit diff shows critical changes where filename assignment was moved to a setFilename() method that performs Jenkins.checkGoodName() validation. The vulnerable versions directly used FileItem.getName() without validation in StashedFileParameterValue constructor and Base64FileParameterValue.setFile. The AbstractFileParameterDefinition.createValue method was vulnerable as it propagated these unvalidated filenames into the build environment. The high confidence comes from explicit path traversal prevention being added in the patch through filename validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:file-parameters | maven | < 285.287.v4b | 285.287.v4b |
Ongoing coverage of React2Shell