Path Traversal in Jenkins Project Robot Framework Plugin
CVE-2026-92137
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content, which can lead to remote code execution.
Vulnerability class: Path Traversal (Directory Traversal)
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- jenkinsci-cert@googlegroups.com (vendor-advisory)
Frequently asked questions
- What is CVE-2026-92137?
- CVE-2026-92137 is a high-severity vulnerability in Jenkins Project Robot Framework Plugin, classified under Path Traversal. CVSS score: 8.8/10. Published 2026-09-16.
- How severe is CVE-2026-92137?
- High severity. CVSS v3 base score is 8.8 out of 10.