Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.jenkins-ci.plugins:external-workspace-manager

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8MavenPublished

    Jenkins External Workspace Manager Plugin has a path traversal vulnerability

    CVE-2026-57296 · GHSA-hrmj-8fm9-cg8x

    Affected
    • Maven org.jenkins-ci.plugins:external-workspace-manager < 1.4.0
    Fixed in
    1.4.0· Vendor fix available
    Issue
    Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject .. path segments when validating the custom workspace path provided to the exwsAllocate Pipeline step, allowing the resulting workspace path to escape the configured disk mount point. This allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution (see Reading Files). External Workspace Manager Plugin 1.4.0 rejects .. path segments when validating the custom workspace path, and additionally verifies that the requested path is contained within the configured disk mount point before serving it through the external workspace browse functionality.

    Recommended action: Upgrade to 1.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →