Jenkins TAP Plugin allows Path Traversal

HIGH 7.5CVE-2016-4986 · GHSA-24jc-w55j-5p83 · Published 09/02/2017 · updated 17/06/2026

In short

CVE-2016-4986 is a HIGH (CVSS 7.5) vulnerability affecting org.tap4j:tap, tap (jenkins).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.4% of all vulnerabilities.
Fix: update to 1.25 or later.

Package	Affected versions	Patched versions
org.tap4j:tap Maven	`< 1.25`	`1.25`
tap jenkins	`< 1.25`	`1.25`

Description

Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter.

NVD description

Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter.

References

nvd.nist.gov/vuln/detail/CVE-2016-4986 · ADVISORY
jenkinsci/tap-plugin commit 8e2a3aa · WEB
jenkinsci/tap-plugin · PACKAGE
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20 · WEB

More vulnerabilities in org.tap4j:tap

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free