Vulnerabilities/Jenkins/CVE-2024-23897
CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownPatch available
CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 19 Aug 2024
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
Recommended action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date 9 Sep 2024 · CWE-27
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins | before 1.606 | 2.442, 2.426.3, 2.440.1 |
| Jenkins | 2.442 and later | 2.442, 2.426.3, 2.440.1 |
| Jenkins | 2.426.3 to before 2.426.* | 2.442, 2.426.3, 2.440.1 |
| Jenkins | 2.440.1 to before 2.440.* | 2.442, 2.426.3, 2.440.1 |
| jenkins | before 1.606 | 2.442, 2.426.3, 2.440.1 |
Show 3 more rows
| jenkins | 2.442 and later | 2.442, 2.426.3, 2.440.1 |
| jenkins | 2.426.3 to before 2.427 | 2.442, 2.426.3, 2.440.1 |
| jenkins | 2.440.1 to before 2.441 | 2.442, 2.426.3, 2.440.1 |
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 19 Aug 2024 · Added to CISA KEV
- 9 Sep 2024 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.