CVE-2025-67643 — Jenkins Project / Jenkins Redpen - Pipeline Reporter for Jira Plugin

CVE-2025-67643

Jenkins Project / Jenkins Redpen - Pipeline Reporter for Jira Plugin PUBLISHED

Description (CNA)

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins Redpen - Pipeline Reporter for Jira Plugin	affected 0 through 1.054.v7b_9517b_6b_202

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3290

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.