Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing the CVE-2026-33001 fix. An admin points a tool installer (DownloadFromUrlInstaller/ZipExtractionInstaller) at an attacker URL; any user's POST /job/{name}/build then extracts the malicious tar, planting symlinks in the tool cache. Sensitive files are read via GET /job/{name}/lastBuild/consoleText or GET /job/{name}/ws/{file}, exposing /etc/passwd, secrets/master.key, and credentials.xml.