7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48921

CVE-2026-48921: Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48921

CVE-2026-48921:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.jenkins.plugins:pipeline-groovy-lib	maven	< 798.v5cc688825312	798.v5cc688825312

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Jenkins Pipeline: Groovy Libraries Plugin's failure to prohibit symbolic links within shared libraries. An attacker with control over the source code of a shared library could introduce a symbolic link pointing to an arbitrary file on the Jenkins controller's filesystem. When a Jenkins Pipeline job uses this malicious library, it could read the contents of the linked file, leading to information disclosure.

The patch addresses this by introducing a new static method, org.jenkinsci.plugins.workflow.libs.SCMBasedRetriever.rejectSpecialFiles. This method recursively scans a given directory path and throws an AbortException if it encounters a symbolic link or any other non-regular file or directory.

This new security check is integrated into the library retrieval process. Specifically, the org.jenkinsci.plugins.workflow.libs.LibraryAdder.retrieve and org.jenkinsci.plugins.workflow.libs.SCMBasedRetriever.doRetrieve methods, which are central to fetching and loading shared libraries, were modified to call rejectSpecialFiles. These functions are the key points in the execution flow where the vulnerability could be exploited, as they are responsible for making the library's contents available to the Pipeline job. Before the patch, these functions would process libraries without this crucial validation step.

Vulnerable functions

org.jenkinsci.plugins.workflow.libs.LibraryAdder.retrieve

src/main/java/org/jenkinsci/plugins/workflow/libs/LibraryAdder.java

This static method is responsible for retrieving a shared library. Before the patch, it would copy the library's contents recursively without checking for symbolic links. This allowed an attacker with control over the library's source code repository to include a symbolic link to an arbitrary file on the Jenkins controller. The patch adds calls to `SCMBasedRetriever.rejectSpecialFiles` to validate the library contents after retrieval, thus mitigating the vulnerability.

org.jenkinsci.plugins.workflow.libs.SCMBasedRetriever.doRetrieve

src/main/java/org/jenkinsci/plugins/workflow/libs/SCMBasedRetriever.java

This method performs the SCM checkout of the library. The vulnerability existed because this method would check out the library files from the source control management system, including any symbolic links, without validation. An attacker could place a symbolic link in the repository, which would then be present on the Jenkins controller's filesystem, allowing for arbitrary file reads. The patch adds a call to the new `rejectSpecialFiles` method to inspect the checked-out files and abort if a symbolic link is found.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.