CVE-2022-36890: Jenkins Deployer Framework

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Affected products

• Jenkins Deployer Framework: up to and including 85.v1d1888e8c021

Published 2022-07-27. Last modified 2026-06-17.