CVE-2026-48920

HIGH

Jenkins Email Extension Plugin < 1933.v45cec755423f - External Control of File Name or Path

Title source: rule

Description

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

Jenkins Security Advisory 2026-05-27

https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3705

Scores

CVSS v3 8.8

EPSS 0.0030

EPSS Percentile 21.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-73

Status published

Products (3)

jenkins/email_extension 1933.v45cec755423f

jenkins/email_extension < 1925.v1598902b_58dd

Jenkins Project/Jenkins Email Extension Plugin < 1933.v45cec755423f

Published May 27, 2026

Tracked Since May 27, 2026