Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3705 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
28 May 2026, 17:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Jenkins
Jenkins email Extension |
|
| CPE | cpe:2.3:a:jenkins:email_extension:1933.v45cec755423f:*:*:*:*:jenkins:*:* cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:* |
|
| References | () https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3705 - Vendor Advisory |
27 May 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-73 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
27 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 15:16
Updated : 2026-05-28 17:14
NVD link : CVE-2026-48920
Mitre link : CVE-2026-48920
CVE.ORG link : CVE-2026-48920
JSON object : View
Products Affected
jenkins
- email_extension
CWE
CWE-73
External Control of File Name or Path