---
id: CVE-2026-33001
title: >-
  Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle
  symbolic links during the extraction of .tar and .tar.gz archives, allowing
  crafted archives to write files to arbitrary locations on the filesystem,
  restricted on…
summary: >-
  Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle
  symbolic links during the extraction of .tar and .tar.gz archives, allowing
  crafted archives to write files to arbitrary locations on the filesystem,
  restricted on…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-59
  - CWE-22
vendor: jenkins
product: jenkins
affected:
  - jenkins < 2.541.3
  - jenkins < 2.555
patched:
  - jenkins 2.555
published: '2026-03-18'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T13:19:17.403'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33001'
references:
  - url: 'https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657'
    label: jenkinsci-cert@googlegroups.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:10199'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10201'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10204'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10205'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10206'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10209'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10211'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10213'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10214'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:10215'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-33001'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2448645'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33001.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-03-19T03:55:23.659873Z'
epss: 0.00667
epssPercentile: 0.49758
ingestedAt: '2026-09-09T13:09:45.313Z'
---

## Overview

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.
This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

## Affected

- `jenkins < 2.541.3`
- `jenkins < 2.555`

## Remediation

Upgrade past the affected range:

- `jenkins 2.555`