Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploa…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 10, 2025 · NIST NVD

   Detected

   Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

2. Oct 14, 2026 · NIST NVD

   Updated

   Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

Affected

• cpe jenkins/redpen - pipeline reporter for jiraversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-67643

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-67643

  30-day exploitation probability 0.3%

  first.org
• NIST NVDVulnerability recordCVE-2025-67643

  Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkin

  nvd.nist.gov

References

• Vendor Advisory · jenkins.io