PT-2026-44013 · Jenkins · Email Extension Plugin

Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-48920

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Email Extension Plugin versions prior to 1933.v45cec755423f

Description The plugin allows inlining images as base64 in email content by setting the data-inline attribute. Because there are no restrictions on the image URLs that can be inlined, attackers who can control the email content can specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.

Recommendations Update to a version later than 1933.v45cec755423f.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-48920

Affected Products

Email Extension Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-48920 · Security Note
• https://jenkins.io/security/advisory/2026-05-27/#SECURITY-3705 · Vendor Advisory
• https://twitter.com/UpwindMDR/status/2059777882109710437 · Twitter Post
• https://t.me/CVEtracker/55125 · Telegram Post
• https://twitter.com/dailycve/status/2060134378756301067 · Twitter Post