CVE-2025-67643: Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability

December 10, 2025

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

References

github.com/advisories/GHSA-qxh4-j39m-qfx4
github.com/jenkinsci/pipeline-reporter-by-redpen-plugin
nvd.nist.gov/vuln/detail/CVE-2025-67643
www.jenkins.io/security/advisory/2025-12-10/

Code Behaviors & Features

Detect and mitigate CVE-2025-67643 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →