CVE-2019-10352

A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.

• CWE-22

• http://www.openwall.com/lists/oss-security/2019/07/17/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/109299Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2503
• https://access.redhat.com/errata/RHSA-2019:2548
• https://jenkins.io/security/advisory/2019-07-17/#SECURITY-1424Vendor Advisory
• https://www.tenable.com/security/research/tra-2019-35Exploit, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/07/17/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/109299Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2503
• https://access.redhat.com/errata/RHSA-2019:2548
• https://jenkins.io/security/advisory/2019-07-17/#SECURITY-1424Vendor Advisory
• https://www.tenable.com/security/research/tra-2019-35Exploit, Third Party Advisory

Published

Jul 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10347Jenkins Mashup Portlets Plugin stored credentials unencrypte…8.8
• CVE-2019-10348Jenkins Gogs Plugin stored credentials unencrypted in job co…8.8
• CVE-2019-10349A stored cross site scripting vulnerability in Jenkins Depen…5.4
• CVE-2019-1035A remote code execution vulnerability exists in Microsoft Wo…7.8
• CVE-2019-10350Jenkins Port Allocator Plugin stores credentials unencrypted…8.8
• CVE-2019-10351Jenkins Caliper CI Plugin stores credentials unencrypted in …8.8
• CVE-2019-10353CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and ea…
• CVE-2019-10354A vulnerability in the Stapler web framework used in Jenkins…4.3
• CVE-2019-10355A sandbox bypass vulnerability in Jenkins Script Security Pl…8.8
• CVE-2019-10356A sandbox bypass vulnerability in Jenkins Script Security Pl…8.8
• CVE-2019-10357A missing permission check in Jenkins Pipeline: Shared Groov…4.3
• CVE-2019-10358Jenkins Maven Integration Plugin 3.3 and earlier did not app…6.5