PT-2026-55144 · Maven · Org.Jenkins-Ci.Plugins:Email-Ext

Published 2026-05-27 · Updated 2026-05-27

OSV

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as base64 in email content by setting the data-inline attribute. No restrictions are placed on the image URLs that can be inlined.

This allows attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.

The feature allowing inlining images as base64 in email content by setting the data-inline attribute is removed from Email Extension Plugin 1933.1935.v276319e3cc47.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

GHSA-MQ58-M26G-46GP

Affected Products

Org.Jenkins-Ci.Plugins:Email-Ext

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-48920 · Security Note
• https://osv.dev/vulnerability/GHSA-mq58-m26g-46gp · Vendor Advisory
• https://github.com/jenkinsci/email-ext-plugin · Note
• https://jenkins.io/security/advisory/2026-05-27/#SECURITY-3705 · Note