{"id":"GHSA-qjq3-wqj5-g37q","summary":"Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries","details":"Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.\n\nThis allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.\n\nPipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.","aliases":["CVE-2026-48921"],"modified":"2026-07-01T19:41:29.145055Z","published":"2026-05-27T15:33:26Z","database_specific":{"github_reviewed_at":"2026-07-01T19:26:57Z","nvd_published_at":"2026-05-27T15:16:31Z","cwe_ids":["CWE-59"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48921"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/pipeline-groovy-lib-plugin"},{"type":"WEB","url":"https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3727"}],"affected":[{"package":{"name":"io.jenkins.plugins:pipeline-groovy-lib","ecosystem":"Maven","purl":"pkg:maven/io.jenkins.plugins/pipeline-groovy-lib"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"798.v5cc688825312"}]}],"versions":["589.vb_a_b_4a_a_8c443c","591.v3a_7f422b_d058","593.595.vfc6485d13dcd","593.va_a_fc25d520e9","598.vcd66b_a_336510","612.614.v48dcb_f62a_640","612.v84da_9c54906d","613.v9c41a_160233f","621.vb_44ce045b_582","629.vb_5627b_ee2104","656.va_a_ceeb_6ffb_f7","671.v07c339c842e8","673.vb_c5d5948283c","685.v8ee9ed91d574","687.v62591d623759","689.veec561a_dee13","700.v0e341fa_57d53","704.vc58b_8890a_384","710.v4b_94b_077a_808","727.ve832a_9244dfa_","730.ve57b_34648c63","740.va_2701257fe8d","744.v5b_556ee7c253","745.vdf6077913de0","749.v70084559234a_","751.v709f84f7d768","752.vdddedf804e72","763.v13008816b_de7","766.v2b_e08c2e6ff2","776.vfee5327b_b_a_5b_","787.ve2fef0efdca_6","797.v90ea_a_9b_e45a_0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qjq3-wqj5-g37q/GHSA-qjq3-wqj5-g37q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}