Jenkins Credentials Binding Plugin Path Traversal Vulnerability Allowing Arbitrary File Write

A path traversal vulnerability has been identified in the Jenkins Credentials Binding Plugin, affecting versions through 719.v80e905ef14eb_. The vulnerability arises because the plugin does not properly sanitize file names for file and zip file credentials. This lack of sanitization enables attackers who can provide credentials to a job to write files to arbitrary locations on the node's filesystem. If Jenkins allows low-privileged users to configure file or zip file credentials for jobs running on the built-in node, this could lead to remote code execution.

Impact

Exploitation of this vulnerability could result in arbitrary file writes on the node filesystem, with the potential for remote code execution if certain conditions are met.

Remediation

Users of the Credentials Binding Plugin should update to version 720.v3f6decef43ea_.