description: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
affected:
{
defaultStatus: affected
product: Jenkins
vendor: Jenkins Project
versions:
lessThan: 1.606, status: unaffected, version: 0, versionType: maven
lessThan: *, status: unaffected, version: 2.442, versionType: maven
lessThan: 2.426.*, status: unaffected, version: 2.426.3, versionType: maven
lessThan: 2.440.*, status: unaffected, version: 2.440.1, versionType: maven
}