CVE-2026-84667 — Jenkins Project / Jenkins ThinBackup Plugin

CVE-2026-84667

Jenkins Project / Jenkins ThinBackup Plugin PUBLISHED

Description (CNA)

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins ThinBackup Plugin	affected 0 through 2.1.4

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4099

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.