CVE-2021-21683: Jenkins

Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days.

The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.

Affected products

• Jenkins Jenkins: up to and including 2.303.1; up to and including 2.314

Published 2021-10-06. Last modified 2026-06-17.