Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-05-27 | 1 | Disclosure1 |
| 2026-05-28 | 1 | Disclosure1 |
| 2026-06-02 | 1 | General1 |
Jenkinsの複数プラグインに脆弱性(CVE-2026-48920,CVE-2026-48921,CVE-2026-48922) https://rocket-boys.co.jp/security-measures-lab/jenkins-plugins-vulnerabilities-cve-2026-48920-48921-48922/ #セキュリティ対策Lab #security #securitynews
Post summary
The post announces three Jenkins plugin CVEs and links to a resource but provides no proof of concept, exploit code, patch, or technical details.
🔴 (Jenkins Email Extension Plugin), Arbitrary File Read, #CVE-2026-48920 (High) -DC-May2026-8 https://dailycve.com/jenkins-email-extension-plugin-arbitrary-file-read-cve-2026-48920-high-dc-may2026-8/
Post summary
A new high‑severity CVE (CVE‑2026‑48920) for Jenkins Email Extension Plugin was disclosed, highlighting an arbitrary file read vulnerability. No PoC, exploit code, active exploitation, or patch details are provided.
🚨 High - Jenkins Email Extension Plugin Arbitrary File Read (CVE-2026-48920) The Jenkins Email Extension Plugin (up to version 1933.v45cec755423f) allows inlining images as base64 in email content via the data-inline attribute. There are no restrictions on the image URLs, enabling attackers who can control email content to specify file: URLs. This allows reading arbitrary files from the Jenkins controller filesystem. 👉Affected: Jenkins Email Extension Plugin <= 1933.v45cec755423f
Post summary
The post announces a high‑severity arbitrary file read flaw in the Jenkins Email Extension Plugin, explaining how attackers can read files from the controller using unrestricted data‑inline image URLs.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jenkins | email_extension | - | jenkins | - |
| App | jenkins | email_extension | 1933.v45cec755423f | jenkins | - |