TI-2024-36159 Aliases CVE-2024-54004 GHSA-fwxq-3f52-5cmc

Path traversal in Jenkins Filesystem List Parameter Plugin

LOW 21CWE-22Published 2024-11-27 · Updated 2024-11-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00795 56th percentileScored 2026-11-07

Fix Fixed aendter.jenkins.plugins:filesystem-list-parameter-plugin (Maven): 0.0.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Filesystem List Parameter Plugin	up to 0.0.14	—	No fix listed	CNA
—	aendter.jenkins.plugins:filesystem-list-parameter-plugin (Maven)	before 0.0.15	0.0.15	Patch available	GHSA-fwxq-3f52-5cmc

Jenkins Filesystem List Parameter Plugin VendorJenkins Affected up to 0.0.14 Fixed in — No fix listed CNA
aendter.jenkins.plugins:filesystem-list-parameter-plugin (Maven) Vendor— Affected before 0.0.15 Fixed in 0.0.15 Patch available GHSA-fwxq-3f52-5cmc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:filesystem_list_parameter::::::jenkins::*	up to 0.0.14	Vulnerable	Jenkins

cpe:2.3:a:jenkins:filesystem_list_parameter:*:*:*:*:*:jenkins:*:* Versions up to 0.0.14 Vulnerable ·Jenkins

Remediation

Fix · GHSA-fwxq-3f52-5cmc aendter.jenkins.plugins:filesystem-list-parameter-plugin (Maven) Fixed in 0.0.15 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-54004
2026-10-03 Alias added: GHSA-fwxq-3f52-5cmc

References

Advisory 2

TI-2022-15102 Cross-site scripting in Jenkins Filesystem List Parameter Plugin CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences