Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-c2jh-gx5w-mqcd
Vulnerability ID VCID-c2jh-gx5w-mqcd
Aliases CVE-2022-30948
GHSA-5786-3qjg-mr88
Summary Path traversal in Jenkins Mercurial Plugin SCMs support a number of different URL schemes, including local file system paths (e.g. using file: URLs). Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well. This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30948.json
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.01803 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.02427 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
epss 0.02427 https://api.first.org/data/v1/epss?cve=CVE-2022-30948
cvssv3.1_qr LOW https://github.com/advisories/GHSA-5786-3qjg-mr88
cvssv3.1 3.7 https://github.com/jenkinsci/mercurial-plugin
generic_textual LOW https://github.com/jenkinsci/mercurial-plugin
cvssv3.1 3.7 https://github.com/jenkinsci/mercurial-plugin/commit/b995436e560b01818f5d9e9920990370cc575341
generic_textual LOW https://github.com/jenkinsci/mercurial-plugin/commit/b995436e560b01818f5d9e9920990370cc575341
cvssv3.1 3.7 https://nvd.nist.gov/vuln/detail/CVE-2022-30948
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2022-30948
cvssv3.1 3.7 https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
generic_textual LOW https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
cvssv3.1 3.7 http://www.openwall.com/lists/oss-security/2022/05/17/8
generic_textual LOW http://www.openwall.com/lists/oss-security/2022/05/17/8
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30948.json
https://api.first.org/data/v1/epss?cve=CVE-2022-30948
https://github.com/jenkinsci/mercurial-plugin
https://github.com/jenkinsci/mercurial-plugin/commit/b995436e560b01818f5d9e9920990370cc575341
https://nvd.nist.gov/vuln/detail/CVE-2022-30948
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
http://www.openwall.com/lists/oss-security/2022/05/17/8
2119644 https://bugzilla.redhat.com/show_bug.cgi?id=2119644
GHSA-5786-3qjg-mr88 https://github.com/advisories/GHSA-5786-3qjg-mr88
RHSA-2023:0017 https://access.redhat.com/errata/RHSA-2023:0017
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30948.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/mercurial-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/mercurial-plugin/commit/b995436e560b01818f5d9e9920990370cc575341
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-30948
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2022/05/17/8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.82762
EPSS Score 0.01803
Published At April 7, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:11:29.284610+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5786-3qjg-mr88/GHSA-5786-3qjg-mr88.json 38.0.0