CoreCVE
Back

MEDIUM

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory

Published Dec 10, 2025

Description

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner jenkins
Published Dec 10, 2025
Updated Dec 10, 2025
Reserved Dec 9, 2025
Link CVE-2025-67643
CISA Vulnrichment
Updated Dec 10, 2025
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2025-67643
Red Hat
Severity n/a
Public date n/a
Links CVE-2025-67643
GHSA-QXH4-J39M-QFX4