Jenkins command line path traversal (CVE-2024-23897) — a flaw giving only limited read access that can lead to code execution
A path traversal vulnerability in the command line interface of the continuous integration platform Jenkins. It is described as allowing limited read access to certain files, which can lead to code execution.
Key facts
- CVE IDCVE-2024-23897
- Affected (vendor / product)Jenkins Jenkins Command Line Interface (CLI)
- CWECWE-27
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2024-09-09 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is the Jenkins command line interface, classified as path traversal involving internal directory traversal.
- The catalog describes what it grants as limited read access to certain files.
- It states nonetheless that this can lead to code execution, showing a read-only flaw is not necessarily minor.
- A continuous integration platform holds privileges and credentials for the environments it delivers to, so effects reach outward.
- Across the records this site holds as of 2026-09-04, development and CI entries with known ransomware use number 20.
1The words limited read access
The catalog describes what this vulnerability grants as limited read access to certain files. Not writing, and not arbitrary files. Yet the sentence continues that this can lead to code execution.
Even where what can be read is narrow, if it holds material for authentication or information about configuration, what becomes possible next changes. This site covers another case where configuration files and hashed passwords could be read out, and the same point recurs: a read-only flaw is not necessarily minor.
2Where a development platform sits
- 1Its roleChecking what was written, assembling it, and distributing it
- 2Privileges it holdsOften privileges to deliver into target environments
- 3Information it holdsCredentials and signing keys may reside there
- 4Direction of effectAn effect here can reach outward to where it distributes
A continuous integration platform exists to check and distribute what has been developed. By role it holds privileges over the environments it delivers to, and the credentials for them. Where it is affected, the effect can reach outward to those environments.
3The development grouping
Across the records this site holds as of 2026-09-04, 20 unpublished entries for major development and continuous integration products carry known ransomware use. Systems built for developing are targeted as much as those running the business.
4The assumption of facing inward
Development platforms are readily treated as internal systems, and may not be designed on the assumption of being reached from outside. Their privileges and the information they hold, meanwhile, are considerable. That mismatch between an inward-facing role and outward-reaching power characterises this grouping.
Why it matters
Development platforms are readily treated as internal, yet the privileges and information they hold are considerable. That mismatch between an inward-facing role and outward-reaching power is the weakness of this grouping.
FAQ
Can reading alone lead to code execution?
Why are development platforms targeted?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).