CVE-2026-84667: Jenkins Project Jenkins Thinbackup Plugin

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

Affected products

• Jenkins Project Jenkins Thinbackup Plugin: up to and including 2.1.4

Published 2026-09-02. Last modified 2026-09-03.