All vulnerabilities
CVE-2026-57296GHSA-hrmj-8fm9-cg8x

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

Jenkins Project org.jenkins-ci.plugins:external-workspace-managermavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.83%Chance of exploitation activity in the next 30 days, higher than 57% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.4.0Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 1.4.0org.jenkins-ci.plugins:external-workspace-manager, mavenGitHub<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>external-workspace-manager</artifactId><version>1.4.0</version></dependency>
  • 1.4.0org.jenkins-ci.plugins:external-workspace-manager, MavenOSV<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>external-workspace-manager</artifactId><version>1.4.0</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject .. path segments when validating the custom workspace path provided to the exwsAllocate Pipeline step, allowing the resulting workspace path to escape the configured disk mount point.

This allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution (see Reading Files).

External Workspace Manager Plugin 1.4.0 rejects .. path segments when validating the custom workspace path, and additionally verifies that the requested path is contained within the configured disk mount point before serving it through the external workspace browse functionality.

Text from GitHub Advisory Database

Affected versions 16

  • org.jenkins-ci.plugins:external-workspace-manager, maven< 1.4.0GitHub
  • Jenkins External Workspace Manager Pluginaffected: all versions through 1.3.2CVE List
  • org.jenkins-ci.plugins:external-workspace-manager, Mavenfrom first release, fixed in 1.4.0OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.0-alpha-1OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.0-beta-1OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.0.0OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.1.0OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.1.1OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.1.2OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.2.0OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.2.1OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.2.2OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.2.3OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.3.0OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.3.1OSV
  • org.jenkins-ci.plugins:external-workspace-manager, Maven1.3.2OSV

References 5