CVE-2026-48920
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as in email content by setting the attribute, without restrictions on the image UR…
Published May 27, 2026 · updated Oct 14, 2026 · jenkins email extension
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as in email content by setting the attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify URLs for images to read arbitrary files from the Jenkins controller filesystem.
Timeline
Detection, updates, and resolution for this record.
May 27, 2026 · NIST NVD
Detected
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as in email content by setting the attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify URLs for images to read arbitrary files from the Jenkins controller filesystem.
Oct 14, 2026 · NIST NVD
Updated
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as in email content by setting the attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify URLs for images to read arbitrary files from the Jenkins controller filesystem.
Affected
- cpe jenkins/email extensionversion unspecified
- cpe jenkins/email extension1933.v45cec755423f
Sources
- CVE.orgCVE-2026-48920
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-48920
30-day exploitation probability 0.5%
first.org - NIST NVDCVE-2026-48920
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as in email content by setting the attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `f
nvd.nist.gov