CVE-2016-4986: Jenkins TAP Plugin allows Path Traversal

May 13, 2022 (updated March 13, 2025)

Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter.

References

github.com/advisories/GHSA-24jc-w55j-5p83
github.com/jenkinsci/tap-plugin
github.com/jenkinsci/tap-plugin/commit/8e2a3aa86ce57a98c69e6038e15ae8fe47d08124
nvd.nist.gov/vuln/detail/CVE-2016-4986
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20

Code Behaviors & Features

Detect and mitigate CVE-2016-4986 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →