A little personal sharing 😂

:))) Okay, so before diving into this blog post, I was actually mind-blown myself that I managed to find and contribute a bug to the Jenkins community. The feeling of satisfaction is indescribable :) finding my first RCE in the world's most popular CI/CD platform, good ol' badass Jenkins. Un-freaking-believable 😎.
This blog post of mine will focus on analyzing the technical details of a Symlink attack in Jenkins Core.
You guys can check out https://www.jenkins.io/security/advisory/2021-11-04/. Most of the bugs related to the FilePath class are publicly disclosed by Jenkins in there.
Also, I did some research on CVE-2021-21602: https://github.com/advisories/GHSA-vpjm-58cw-r8q5. This was the predecessor and essentially the catalyst that led to my bug :))). Alright, let's get into it!
You can find my advisory here: https://www.jenkins.io/security/advisory/2026-03-18/. Honestly though, I have no damn idea why Jenkins gave it such a weird-ass title—taking a solid RCE bug and naming it something so trippy and bizarre 🤨.

Description