CVE-2026-48920
Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.
- Record
CVE-2026-48920- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-02
EUVDEUVD-2026-32511
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.
- Record
EUVD-2026-32511- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mq58-m26g-46gp
Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as base64 in email content by setting the data-inline attribute. No restrictions are placed on the image URLs that can be inlined.
This allows attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.
The feature allowing inlining images as base64 in email content by setting the data-inline attribute is removed from Email Extension Plugin 1933.1935.v276319e3cc47.
- Record
GHSA-mq58-m26g-46gp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-02
NVD
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.
- Record
CVE-2026-48920- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-02
OSV
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.
- Record
CVE-2026-48920- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-mq58-m26g-46gp
Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as base64 in email content by setting the data-inline attribute. No restrictions are placed on the image URLs that can be inlined.
This allows attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.
The feature allowing inlining images as base64 in email content by setting the data-inline attribute is removed from Email Extension Plugin 1933.1935.v276319e3cc47.
- Record
GHSA-mq58-m26g-46gp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:email-extMaven |
before 1933.1935.v276319e3cc47 | 1933.1935.v276319e3cc47 |
org.jenkins-ci.plugins:email-extMaven |
before 1933.1935.v276319e3cc47, plus listed versions 1806.v856a_01a_fa_39a_1814.v404722f342631844.v3ea_a_b_842374a_1849.v6dd03b_f6e4231851.v2b_5345e6272d Show 45 moreShow less1855.vd9e491cb_de1e1861.vdb_d9915909941866.v14fa_6d2016541876.v28d8d38315b_d1911.v19b_8e86f98151916.vc954a_f86ff211922.v5c93c9e80a_f91925.v1598902b_58dd1933.v45cec755423f2.1002.1012.1022.1032.1042.1052.112.122.132.142.14.12.152.162.182.192.202.212.222.24.12.252.272.27.12.282.292.302.30.12.30.22.312.322.332.342.352.35.12.362.372.37.1 |
1933.1935.v276319e3cc47 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48920 is a high vulnerability (CVSS 8.8) in Jenkins Email Extension, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in org.jenkins-ci.plugins:email-ext 1933.1935.v276319e3cc47.
References
Left out here: 83 versions. The JSON record has them.