Arch Linux: Arbitrary filesystem access (CVE-2021-21697)

Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins before 2.319 include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (build.xml and some Pipeline-related metadata).

Jenkins 2.319 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory.