CVE-2026-48920

High

Description

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Jenkins Email Extension

PublishedMay 27, 2026

First seenMay 27, 2026

Weakness typeCWE-73CWE-73

How to fix

Update

org.jenkins-ci.plugins:email-ext1933.1935.v276319e3cc47 or later

Vendor advisories

jenkins.io/security/advisory/2026-05-27/#SECURITY-3705

Affected products

Product	Affected versions	Fixed in
jenkins email_extension	v ≤ 1925.v1598902b_58dd, 1933.v45cec755423f	—
org.jenkins-ci.plugins:email-extMaven	v < 1933.1935.v276319e3cc47	1933.1935.v276319e3cc47

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.