Skip to content
Heist/ feed
HighFix available

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

Type: advisorySource: OSV1 source record

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject `..` path segments when validating the custom workspace path provided to the `exwsAllocate` Pipeline step, allowing the resulting workspace path to escape the configured disk mount point. This allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution (see Reading Files). External Workspace Manager Plugin 1.4.0 rejects `..` path segments when validating the custom workspace path, and additionally verifies that the requested path is contained within the configured disk mount point before serving it through the external workspace browse functionality.

Announced Source revision 1
Original source ↗

GHSA-hrmj-8fm9-cg8x

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-hrmj-8fm9-cg8x

org.jenkins-ci.plugins:external-workspace-manager

Source reference: /affected/0/package/name

Affected versions
1.0-alpha-1

Source reference: /affected/0/versions

1.0-beta-1

Source reference: /affected/0/versions

1.0.0

Source reference: /affected/0/versions

1.1.0

Source reference: /affected/0/versions

1.1.1

Source reference: /affected/0/versions

1.1.2

Source reference: /affected/0/versions

1.2.0

Source reference: /affected/0/versions

1.2.1

Source reference: /affected/0/versions

1.2.2

Source reference: /affected/0/versions

1.2.3

Source reference: /affected/0/versions

1.3.0

Source reference: /affected/0/versions

1.3.1

Source reference: /affected/0/versions

1.3.2

Source reference: /affected/0/versions

Fixed versions
1.4.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.4.0"
          }
        ]
      }
    ],
    "package": {
      "name": "org.jenkins-ci.plugins:external-workspace-manager",
      "purl": "pkg:maven/org.jenkins-ci.plugins/external-workspace-manager",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.0-alpha-1",
      "1.0-beta-1",
      "1.0.0",
      "1.1.0",
      "1.1.1",
      "1.1.2",
      "1.2.0",
      "1.2.1",
      "1.2.2",
      "1.2.3",
      "1.3.0",
      "1.3.1",
      "1.3.2"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hrmj-8fm9-cg8x/GHSA-hrmj-8fm9-cg8x.json"
    }
  }
]
Related CVEs
CVE-2026-57296

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Event
#17849 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement