PT-2026-55144 · Maven · Org.Jenkins-Ci.Plugins:Email-Ext

Publicado 2026-05-27 · Atualizado 2026-05-27

OSV

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as base64 in email content by setting the data-inline attribute. No restrictions are placed on the image URLs that can be inlined.

This allows attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.

The feature allowing inlining images as base64 in email content by setting the data-inline attribute is removed from Email Extension Plugin 1933.1935.v276319e3cc47.

Correção

Enumeração de Fraquezas

CWE-73

Identificadores relacionados

GHSA-MQ58-M26G-46GP

Produtos afetados

Org.Jenkins-Ci.Plugins:Email-Ext

Referências · 4

• https://github.com/jenkinsci/email-ext-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-48920 · Nota de Segurança
• https://jenkins.io/security/advisory/2026-05-27/#SECURITY-3705 · Nota
• https://osv.dev/vulnerability/GHSA-mq58-m26g-46gp · Aviso do Fabricante