ZeroDay Findings
Sign inSign up

Findings

CVE-2024-23897

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Published Jan 24, 2024 · updated Jun 17, 2026 · jenkins jenkins

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 24, 2024 · Catalog

    Detected

    Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

  2. Aug 19, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Sep 9, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Sep 9, 2024

Affected

  • cpe jenkins/jenkinsversion unspecified
  • vendor Jenkins Jenkins Command Line Interface (CLI)version unspecified

Sources

  • CISA KEVCVE-2024-23897

    Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.

    cisa.gov
  • CVE.orgCVE-2024-23897

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-23897

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database51993

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_gather/jenkins_cli_ampersand_arbitrary_file_read

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2024-23897

    Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins contro

    nvd.nist.gov

References

CVE-2024-23897 · ZeroDay Findings