CVE-2026-48922

score

<0.1

cvss

7.5

epss

0.6%

published

2026-05-27

kev added

—

first seen

2026-10-21

Jenkins Credentials Binding Plugin <= 720.v3f6decef43ea_ contains a file write vulnerability caused by improper sanitization of file names for file and zip file credentials, letting attackers with job credential access write files arbitrarily on the node filesystem, potentially leading to remote code execution if configured to allow low-privileged users to configure such credentials.