CVE-2022-23107: Jenkins Warnings Next Generation

High severity, CVSS 8.1. EPSS: 1.9% chance of exploitation in the next 30 days.

Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system.

Affected products

• Jenkins Warnings Next Generation: from 9.0.0, before 9.0.2 (fixed in 9.0.2); from 9.5.0, before 9.5.2 (fixed in 9.5.2); from 9.10.0, up to and including 9.10.2; version 9.7.0 only

Published 2022-01-12. Last modified 2026-06-17.