← console
voxell vciy

CVE-2023-46654

ROUTINE

Telemetry drift only. No threshold crossed and no authority ruling changed.

CVE record, CISA KEV and EPSS as of 2026-10-18.

CVEs like this one computed, by meaning

What to do now held facts and links

  1. No fix version is held. The CNA's first reference is the place to look: jenkins.io
  2. Record your decision, dated and frozen with today's evidence: patch by a date · mitigated by a compensating control · deferred · accepted the risk · not affected
  3. Check your version against the ranges this record publishes.

What it is stated by the CNA

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system.

weakness
Not named by the CNA. NVD maps it to CWE-59.
affected
Jenkins Project Jenkins CloudBees CD Plugin
published ranges
jenkins cloudbees cd <= 1.1.32
fixed in
No fix version in held sources.
fixed by package (from OSV advisories)
org.jenkins-ci.plugins:electricflow (Maven): 1.1.33 GHSA-jx7x-rf3f-j644
assigned by
jenkins
published
2023-10-25

check us jenkins.io openwall.com

Exploit code held, dated

exploit code
None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

dateEPSSevent
26 Oct 20230.00043
2 Nov 20230.00046
24 Sep 20240.00053
31 Oct 20240.00073
17 Dec 20240.00062
17 Mar 20250.00218scoring model v2025.03.14
29 Mar 20250.00358
30 Mar 20250.00218
15 Apr 20250.00089
17 Oct 20250.00092
27 Oct 20250.00089
18 Nov 20250.00221
21 Nov 20250.00089
4 Mar 20260.00116
15 Jun 20260.0135scoring model v2026.06.15

15 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

What would change this brief held, dated

CISA KEV
Not listed in the catalogue we hold. A listing changes this brief.
exploit probability
0.01 on 2026-06-15 (FIRST's EPSS, a probability and not evidence of exploitation). Next band line: 10% (0.10). Crossing a line changes this brief.
fix
No fix version is held. One published by the CNA or OSV changes this brief.

Watch this CVE What counts as a move

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2023-46654', '2026-10-30T23:59:59.999999Z', now());