CVE-2026-42520

score

<0.1

cvss

7.5

epss

0.6%

published

2026-04-29

kev added

—

first seen

2026-10-21

Jenkins Credentials Binding Plugin <= 719.v80e905ef14eb_ contains an unrestricted file write vulnerability caused by unsanitized file names in file and zip file credentials, letting attackers with job credential access write files arbitrarily on the node filesystem, potentially leading to remote code execution if configured to allow low-privileged users to configure such credentials.