Jenkins File Parameter Plugin arbitrary file write vulnerability

HIGH 8.8CVE-2023-32986 · GHSA-46f2-x6h2-x9hx · Published 16/05/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
io.jenkins.plugins:file-parameters Maven	`< 285.287.v4b`	`285.287.v4b`
file parameters jenkins	`≤ 285.287.v4b_7b_29d3469d`	No fix yet

Description

Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters.

This allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

File Parameter Plugin 285.287.v4b_7b_29d3469d restricts the name (and resulting uploaded file name) of Stashed File Parameters.

NVD description

Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

References

nvd.nist.gov/vuln/detail/CVE-2023-32986 · ADVISORY
jenkinsci/file-parameters-plugin commit 4b7b29d · WEB
jenkins.io/security/advisory/2023-05-16 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free