What’s Vulnerable › Vulnerabilities

CVE-2026-48920

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-27 · updated 2026-10-14
• Weakness: CWE-73

Description

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

Affected products

• Jenkins Project Jenkins Email Extension Plugin: through 1925.v1598902b_58dd; 1933.v45cec755423f

References

• https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3705

Get alerted when CVE-2026-48920 or the next vulnerability affects your stack