CVE-2021-21615: Jenkins

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

Affected products

• Jenkins Jenkins: before 2.263.3 (fixed in 2.263.3); before 2.276 (fixed in 2.276)

Published 2021-01-26. Last modified 2026-06-17.