What is the CVSS score of CVE-2026-48920?

CVE-2026-48920 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jenkins are affected by CVE-2026-48920?

Jenkins Email Extension Plugin (email-ext) versions 1933.v45cec755423f and earlier contains an arbitrary file disclosure vulnerability (CVE-2026-48920, CVSS 8.8) allowing authenticated users with…. A patch is available.

How to fix or mitigate CVE-2026-48920?

24 hours: Identify all Jenkins controllers running email-ext version 1933.v45cec755423f or earlier; restrict 'Edit email notification' job permission to senior administrators only; audit all email templates for file:// URLs. 7 days: Monitor Jenkins audit logs for email configuration changes; rotate all Jenkins credentials and API keys stored on affected controllers as precautionary measure. 30 days: Deploy vendor patch for email-ext immediately upon availability; disable email-ext plugin if non-critical; implement alternative secure email notification mechanism.

Jenkins CVE-2026-48920

EUVD-2026-32511 HIGH

External Control of File Name or Path (CWE-73)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-mq58-m26g-46gp

Information Disclosure Jenkins Red Hat

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:10 vuln.today

DescriptionCVE.org

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.

AnalysisAI

Arbitrary file disclosure in the Jenkins Email Extension Plugin (email-ext) versions 1933.v45cec755423f and earlier lets users who can control email content abuse the data-inline image attribute to supply file: URLs, causing the Jenkins controller to read local files and embed their contents as base64 inside outgoing emails. An authenticated attacker with rights to edit job email configuration or templates (CVSS PR:L) can exfiltrate controller secrets, credentials, and configuration. There is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as none, but the CVSS 8.8 score and 'total' technical impact make controller secret theft a serious concern in shared Jenkins environments.