CVE-2026-48920CWE-73

CVE-2026-48920

High · published May 27, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00509 · 42.6th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-05-27T19:16Z
Affected products (2)
ProductVersionsFixed in
jenkins/email_extension≤ 1925.v1598902b_58dd—
jenkins/email_extensionall versions—
References (1)
https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3705 · [email protected]
EPSS history
Timeline
  • 27 MAY 14:13Z
    Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute…
    cvelistv5