CVE-2026-84667

7.1 highEPSS 0.4%

High (7.1). EPSS 0.4% chance of exploitation in the next 30 days.

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

Severity

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-09-02
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4099

Check your stack JSON