CVE-2026-92137

Executive Summary

CVE-2026-92137 is a path traversal vulnerability (CWE-22) in the Jenkins Robot Framework Plugin, affecting version 6.2.2 and earlier. The plugin fails to validate that the archive directory configured for Robot Framework report files resides within the Jenkins build directory on the controller, allowing an authenticated attacker with Item/Configure permission to write arbitrary files with attacker-controlled content to the Jenkins controller filesystem. Successful exploitation can escalate to remote code execution on the controller, yielding a CVSS v3.1 base score of 8.8 (High).

Technical Analysis

The Jenkins Robot Framework Plugin allows Jenkins jobs to execute Robot Framework test suites and subsequently publish and archive the resulting report files. As part of this workflow, an operator configures an "archive directory" — the location on the build workspace from which output artifacts are collected and preserved.

The core defect is a missing path-containment check. The plugin does not verify that the attacker-supplied archive directory path, once resolved, remains within the build directory on the Jenkins controller. Because no canonicalization or boundary validation is performed, a path containing traversal sequences (for example, ../ segments) or an equivalent absolute path can resolve outside the intended build directory. The result is that the plugin's file-copy and archive logic writes to a location chosen by the attacker rather than a location bounded by the build workspace.

This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) condition. The vulnerability is triggered through configuration data the attacker controls: the archive directory setting. The attacker does not require any code execution primitive to initiate the write — the plugin itself performs the file write on the controller. The content written is attacker-specified (reports/artifacts are copied during the archive step), giving the attacker both location control and content control.

Two permission boundaries are relevant. First, the attacker must possess Item/Configure permission on at least one Jenkins job, which is a low-privilege, commonly delegated role in many Jenkins deployments. Second, the impact lands on the Jenkins controller filesystem itself — the most sensitive node in a Jenkins topology, since it hosts credentials, configuration, plugin binaries, and job definitions.

Because the write occurs on the controller, the standard Jenkins threat model (treating agents as untrusted and the controller as trusted) is violated. Arbitrary file write on the controller is a well-understood escalation path to remote code execution (for example, overwriting artifacts the controller later executes or loads). The NVD description explicitly notes that exploitation "can lead to remote code execution," though it does not prescribe a specific RCE technique. Analysts should treat the RCE outcome as a plausible consequence of arbitrary controller-side file write rather than a guaranteed, single-step primitive.

No public proof-of-concept, Nuclei template, or exploit code is currently known for this CVE. The attack chain below is therefore inferred from the vulnerability class (path traversal in an archive/publish action) and constrained strictly to the mechanics stated in the NVD description.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker first identifies a Jenkins controller running the Robot Framework Plugin at version 6.2.2 or earlier. This is observable through the Jenkins web UI, plugin management pages (/pluginManager/), and build logs referencing Robot Framework report publishing. The attacker must already hold a Jenkins account with Item/Configure permission on at least one job — a low bar in environments where build configuration is broadly delegated.

2. Triggering the flaw. Using Item/Configure permission, the attacker edits a job that uses the Robot Framework Plugin and sets the "archive directory" for Robot Framework report files to a path that escapes the build directory on the controller. Path traversal sequences or an out-of-bounds absolute path are used to redirect where the plugin believes report files live. Because the plugin does not check that this directory is contained within the build directory, the malicious path is accepted.

3. Payload / execution at the vulnerability-class level. On the next build, the plugin copies/archives files from the attacker-controlled location to the destination dictated by the traversal path, writing attacker-specified content to an arbitrary path on the Jenkins controller filesystem. The attacker supplies the content that is written. No public PoC exists; the precise file payloads and traversal strings are not documented in available sources and are not invented here.

4. Post-exploitation impact. Arbitrary file write on the Jenkins controller enables overwriting of files that the controller subsequently executes or trusts, providing a route to remote code execution on the controller as described by NVD. Given the controller's role, this exposes stored credentials, secrets, job definitions, and the ability to pivot into build agents and connected systems.

Impact Assessment

The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8 (High):

• AV:N (Network) — exploitation is performed over the network via the Jenkins web interface.
• AC:L (Low) — no special conditions or race windows are required; a crafted configuration is sufficient.
• PR:L (Low) — the attacker needs only Item/Configure permission, a low-privilege role frequently granted in shared Jenkins environments.
• UI:N (None) — no victim interaction is required.
• S:U (Unchanged) — impact is scored within the vulnerable component's security authority.
• C:H / I:H / A:H — high confidentiality, integrity, and availability impact, consistent with arbitrary controller-side file write that can lead to RCE.

Business impact: The Jenkins controller is the trust anchor of a CI/CD pipeline. Arbitrary file write on it can result in code execution, theft of credentials and secrets used for deployment, tampering with software being built (potential supply-chain effects on downstream artifacts), and destruction or disruption of pipelines. Blast radius: Any organization running the affected plugin with jobs whose configuration is delegated beyond a small trusted set. Current risk modifiers: No known public exploit, no CISA KEV listing, and no EPSS score assigned yet reduce immediate likelihood, but the unpatched status (patch confidence 0/4) elevates exposure for internet- or broadly-accessible controllers.

Detection Guidance

Sigma Rule

title: Jenkins Robot Framework Plugin Path Traversal Configuration Change
id: 9f3c1a72-4b8e-4d21-9a55-0c7e2f6b1d34
status: experimental
description: Detects modification of Jenkins job configuration where a Robot Framework archive directory references path traversal sequences or an out-of-build location, consistent with CVE-2026-92137.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92137
author: SOC / Threat Intelligence
date: 2026/01/01
logsource:
  product: jenkins
  service: audit
detection:
  selection_action:
    event_type: 'config_changed'
  selection_plugin:
    - 'robotframework'
    - 'robot-framework'
  selection_traversal:
    archiveDirectory|contains:
      - '../'
      - '..\\'
      - '%2e%2e'
  condition: selection_action and selection_plugin and selection_traversal
falsepositives:
  - Legitimate but unusual job configuration
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.92137

YARA Rule

rule CVE_2026_92137_Jenkins_RobotFramework_Traversal
{
    meta:
        description = "Detects Robot Framework Plugin configuration containing path traversal in the archive directory, associated with CVE-2026-92137"
        author = "SOC / Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92137"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "robotframework" nocase
        $p2 = "robot-framework" nocase
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e"

    condition:
        (any of ($p1, $p2)) and (any of ($traversal1, $traversal2, $traversal3))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-92137 Jenkins Robot Framework Plugin Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"configSubmit"; nocase; http.request_body; content:"robotframework"; nocase; http.request_body; content:"../"; nocase; reference:cve,2026-92137; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92137; classtype:attempted-admin; sid:202692137; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ process where event.action == "post" and
      process.command_line like~ "*configSubmit*" and
      process.command_line like~ "*robotframework*" and
      (process.command_line like~ "*../*" or process.command_line like~ "*%2e%2e*") ]

Splunk SPL Query

index=jenkins sourcetype=jenkins:audit OR sourcetype=jenkins:log
| search ("robotframework" OR "robot-framework")
| search (("archiveDirectory" OR "config") AND ("../" OR "..\\" OR "%2e%2e"))
| stats count min(_time) as first_seen max(_time) as last_seen by user, job_name, src_ip
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="jenkins,cve-2026-92137,">
  <rule id="100137" level="12">
    <decoded_as>json</decoded_as>
    <field name="plugin">robotframework</field>
    <field name="archiveDirectory">\.\./</field>
    <description>CVE-2026-92137: Jenkins Robot Framework Plugin archive directory path traversal detected - potential arbitrary file write on controller.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or official workaround is currently available.

1. Immediate mitigations

• Restrict who holds Item/Configure permission on Jenkins jobs. Audit and remove this permission from untrusted or broadly-scoped accounts.
• Disable or uninstall the Jenkins Robot Framework Plugin if it is not essential to pipeline operations.
• Isolate the Jenkins controller: do not expose it directly to untrusted networks or the internet; enforce authentication and place it behind network controls.
• Monitor job configuration changes and controller filesystem writes for traversal patterns as described in the detection guidance above.

2. Patch / upgrade steps

• Track the Jenkins plugin security advisories page and NVD entry for CVE-2026-92137. When a fixed plugin version is released, upgrade to it immediately and remove any temporary plugin disablement.
• Until a fix exists, apply compensating controls (permission tightening + plugin disablement) rather than relying on a nonexistent patch.

3. Long-term hardening

• Enforce least privilege on Jenkins: minimize Item/Configure and other high-impact permissions; adopt role-based access control.
• Harden the controller per Jenkins best practices (treat the controller as a sensitive system, run builds on agents, restrict controller file access).
• Add CI/CD configuration-change monitoring and file-integrity monitoring on the controller filesystem.
• Validate third-party plugins against security advisories as part of a routine dependency-review process.

References

• NVD — CVE-2026-92137: https://nvd.nist.gov/vuln/detail/CVE-2026-92137
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• Jenkins Security Advisories (plugin advisories index): https://www.jenkins.io/security/advisories/
• Jenkins Security — plugin and controller hardening guidance: https://www.jenkins.io/doc/book/security/
• CISA Known Exploited Vulnerabilities Catalog (check for future addition): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor note: No public proof-of-concept, exploit code, Nuclei template, or known threat-actor campaign is currently associated with CVE-2026-92137. EPSS has not yet been scored by FIRST.org. No specific file paths, function names, or PoC payloads are documented in available sources; this report is limited to the vulnerability class and mechanics stated in the NVD description.