CVE-2018-6356

An issue was discovered in the Extended Choice Parameter (aka extended-choice-parameter) plugin 0.64 for Jenkins 2.89.3. The PATH_INFO filename is vulnerable to path traversal attacks via .. sequences to the /plugin/extended-choice-parameter/js/ URI.

Source: CVE-2018-6356