CVE-2024-23897: Jenkins CLI Arbitrary File Read / RCE

CVE-2024-23897 is a path-traversal flaw in Jenkins' CLI command parser: the args4j library's default '@file' expansion feature was left enabled, so an unauthenticated remote attacker can make the Jenkins controller read and echo back the contents of arbitrary files, and because several CLI commands accept binary or serialized data this way, the bug can escalate to remote code execution — CISA records it as having been used in ransomware intrusions.

CVE-2024-23897 is a path traversal vulnerability (CWE-22/CWE-27) in Jenkins' built-in command-line interface (CLI). Jenkins uses the args4j library to parse CLI command arguments, and by default args4j replaces an @ character followed by a file path in an argument with the contents of that file. Jenkins did not disable this feature, so an unauthenticated attacker who can reach the CLI endpoint can supply @/path/to/file as an argument to any CLI command and have the controller read that file back — including files the attacker should never be able to read, such as credentials stored on disk. Because several CLI commands also accept this expanded content as serialized data or in ways that affect further processing, the Jenkins security team and third-party researchers documented ways to escalate the arbitrary file read into full remote code execution (Jenkins Security Advisory 2024-01-24 / SECURITY-3314).

NVD's own analysis rates the flaw CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required, full compromise of confidentiality, integrity and availability (NVD).

Jenkins' advisory lists weekly releases 2.441 and earlier (fixed in 2.442) and LTS releases 2.426.2 and earlier (fixed in 2.426.3) as affected, and states that disabling access to the CLI — which does not require a restart — is expected to fully prevent exploitation for administrators who cannot patch immediately (Jenkins Security Advisory 2024-01-24).

CISA added CVE-2024-23897 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-08-19 with a required-action due date of 2024-09-09, and flags known ransomware campaign use, consistent with Jenkins controllers' frequent access to source code, build secrets and deployment credentials (CISA KEV).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.99999 (99.995th percentile), among the highest EPSS scores tracked, reflecting how widely and persistently this flaw continues to be scanned for and exploited (FIRST EPSS).

Any Jenkins controller on an affected build should be upgraded to 2.442 (weekly) or 2.426.3 / 2.440.1 (LTS) immediately; where patching must wait, disabling CLI access is an effective interim mitigation, and credentials stored on an exposed controller should be rotated.

• Jenkins' CLI command parser leaves enabled args4j's default '@file' expansion, letting an unauthenticated attacker make the controller read arbitrary files, with documented escalation paths to remote code execution via several CLI commands. — Jenkins Security Advisory 2024-01-24 / SECURITY-3314
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per NVD's own analysis. — NVD
• Affected: Jenkins weekly 2.441 and earlier (fixed 2.442); Jenkins LTS 2.426.2 and earlier (fixed 2.426.3). Disabling CLI access prevents exploitation without requiring a restart. — Jenkins Security Advisory 2024-01-24 / SECURITY-3314
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-08-19, due date 2024-09-09, with known ransomware campaign use. — CISA KEV
• EPSS score is 0.99999 (99.995th percentile) as of 2026-10-30. — FIRST EPSS