Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3ynh-xzxn-jkgy
Vulnerability ID VCID-3ynh-xzxn-jkgy
Aliases CVE-2021-21602
GHSA-vpjm-58cw-r8q5
Summary Arbitrary file read vulnerability in workspace browsers in Jenkins The file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier. This allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser. This issue is caused by an incomplete fix for SECURITY-904 / CVE-2018-1000862 in the [2018-12-08 security advisory](https://www.jenkins.io/security/advisory/2018-12-05/#SECURITY-904). Jenkins 2.275, LTS 2.263.2 no longer supports symlinks in workspace browsers. While they may still exist on the file system, they are no longer shown on the UI, accessible via URLs, or included in directory content downloads. This fix only changes the behavior of the Jenkins UI. Archiving artifacts still behaves as before.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-21602.json
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
epss 0.01393 https://api.first.org/data/v1/epss?cve=CVE-2021-21602
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-vpjm-58cw-r8q5
cvssv3.1 6.5 https://github.com/jenkinsci/jenkins
generic_textual MODERATE https://github.com/jenkinsci/jenkins
cvssv3.1 6.5 https://github.com/jenkinsci/jenkins/commit/71d2ecf1a4e5303e80815eaa3935c4f2fa3d9104
generic_textual MODERATE https://github.com/jenkinsci/jenkins/commit/71d2ecf1a4e5303e80815eaa3935c4f2fa3d9104
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2021-21602
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-21602
archlinux High https://security.archlinux.org/AVG-1446
cvssv3.1 6.5 https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452
generic_textual MODERATE https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-21602.json
https://api.first.org/data/v1/epss?cve=CVE-2021-21602
https://github.com/jenkinsci/jenkins
https://github.com/jenkinsci/jenkins/commit/71d2ecf1a4e5303e80815eaa3935c4f2fa3d9104
https://nvd.nist.gov/vuln/detail/CVE-2021-21602
https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452
1925161 https://bugzilla.redhat.com/show_bug.cgi?id=1925161
ASA-202101-41 https://security.archlinux.org/ASA-202101-41
AVG-1446 https://security.archlinux.org/AVG-1446
GHSA-vpjm-58cw-r8q5 https://github.com/advisories/GHSA-vpjm-58cw-r8q5
RHSA-2021:0423 https://access.redhat.com/errata/RHSA-2021:0423
RHSA-2021:0429 https://access.redhat.com/errata/RHSA-2021:0429
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-21602.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jenkinsci/jenkins
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jenkinsci/jenkins/commit/71d2ecf1a4e5303e80815eaa3935c4f2fa3d9104
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-21602
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.80322
EPSS Score 0.01393
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:11:05.737175+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vpjm-58cw-r8q5/GHSA-vpjm-58cw-r8q5.json 38.0.0