EUVD-2026-32511
GHSA-mq58-m26g-46gp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
Arbitrary file disclosure in the Jenkins Email Extension Plugin (email-ext) versions 1933.v45cec755423f and earlier lets users who can control email content abuse the data-inline image attribute to supply file: URLs, causing the Jenkins controller to read local files and embed their contents as base64 inside outgoing emails. An authenticated attacker with rights to edit job email configuration or templates (CVSS PR:L) can exfiltrate controller secrets, credentials, and configuration. There is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as none, but the CVSS 8.8 score and 'total' technical impact make controller secret theft a serious concern in shared Jenkins environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Email Extension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.
Executive ViewAI
Jenkins Email Extension Plugin (email-ext) versions 1933.v45cec755423f and earlier contains an arbitrary file disclosure vulnerability (CVE-2026-48920, CVSS 8.8) allowing authenticated users with email configuration rights to exfiltrate controller secrets and credentials. This creates immediate risk of unauthorized access to deployment credentials, API keys, and infrastructure configurations in shared Jenkins environments. No vendor-released patch identified at time of analysis, requiring immediate access controls and monitoring.
24 hours: Identify all Jenkins controllers running email-ext version 1933.v45cec755423f or earlier; restrict 'Edit email notification' job permission to senior administrators only; audit all email templates for file:// URLs. 7 days: Monitor Jenkins audit logs for email configuration changes; rotate all Jenkins credentials and API keys stored on affected controllers as precautionary measure. 30 days: Deploy vendor patch for email-ext immediately upon availability; disable email-ext plugin if non-critical; implement alternative secure email notification mechanism.
Restrict email notification job permission to minimal set of trusted administrators; disable email-ext plugin if unused; implement network monitoring for suspicious email content patterns; conduct immediate audit and rotation of all Jenkins credentials and secrets; use Jenkins credential domain isolation to limit sensitive secret access; evaluate alternative email notification systems with sandbox containment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Email Extension
View allIn Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Securit
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudso
Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the globa
An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/r
Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or
Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resu
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured S
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another use
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing at
Exploit-DB