CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

  • Published Sep 2, 2026
  • CVSS 7.1 high
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-84667 at the National Vulnerability Database