XXE vulnerability in Jenkins Filesystem Trigger Plugin

HIGH 8.8CVE-2021-21657 · GHSA-cphv-7cxw-5hcc · Published 25/05/2021 · updated 17/06/2026

In short

CVE-2021-21657 is a HIGH (CVSS 8.8) vulnerability affecting org.jenkins-ci.plugins:fstrigger, filesystem trigger (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.8% of all vulnerabilities.
Fix: update to 0.41 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:fstrigger Maven	`< 0.41`	`0.41`
filesystem trigger jenkins	`≤ 0.40`	No fix yet

Description

Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Job/Configure permission or otherwise able to control the contents of an XML file being polled for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.

Jenkins Filesystem Trigger Plugin 0.41 disables external entity resolution for its XML parser.

NVD description

Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

References

nvd.nist.gov/vuln/detail/CVE-2021-21657 · ADVISORY
jenkinsci/fstrigger-plugin · PACKAGE
jenkins.io/security/advisory/2021-05-25 · WEB
openwall.com/lists/oss-security/2021/05/25/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free