Agent-to-controller security bypass in Jenkins Squash TM Publisher (Squash4Jenkins) Plugin allows writing arbitrary files

published 2021-11-12 4 y ago modified 2026-06-17 4 mo ago also GHSA-h648-gj34-5x4r , EUVD-2022-4078

cvss: 8.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits: 0; none known

Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.

Exploit prediction

1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD	2.0	5.5	AV:N/AC:L/Au:S/C:N/I:P/A:P
GitHub	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.plugins:squashtm-publisher-plugin	<=1.0.0	no fix listed

Affected products

Jenkins project Jenkins Squash TM Publisher (Squash4Jenkins) Plugin

Classification

Weakness

CWE-693 Protection Mechanism Failure

References

jenkins.io /security/advisory/2021-11-12/#SECURITY-2525
web, vendor-advisory
openwall.com /lists/oss-security/2021/11/12/1
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-43578
advisory
github.com /jenkinsci/squashtm-publisher-plugin
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary