CVE-2025-53651: Jenkins HTML Publisher Plugin Vulnerability Exposes Controller File System Information
Summary
CVE-2025-53651: Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs. Affects org.jenkins-ci.plugins:htmlpublisher versions < 427. Fixed in 427. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins HTML Publisher Plugin is a widely used tool that allows users to publish HTML reports generated during the build process in Jenkins. It is designed to enhance the visibility of build results by providing a user-friendly way to display HTML content. However, versions 425 and earlier of this plugin have a significant vulnerability that can expose sensitive information about the Jenkins controller's file system through log messages.
Vulnerability Detail
The vulnerability in the Jenkins HTML Publisher Plugin arises from its logging mechanism, which, in versions 425 and earlier, displays absolute paths of files archived during the Publish HTML reports post-build step. This can lead to information disclosure, as attackers or unauthorized users may gain insights into the directory structure and sensitive files on the Jenkins controller. The issue is classified under CWE-36 (Absolute Path Traversal) and CWE-779 (Improper Restriction of the Operations of a Privileged User).
How To Fix
Latest published version: 429 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
427
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the Jenkins build logs to only authorized personnel, thereby reducing the risk of information exposure until the plugin is updated.
Conclusion
The Jenkins HTML Publisher Plugin vulnerability (CVE-2025-53651) poses a risk of exposing sensitive file system information through log messages. It is crucial for users to update to version 427 or later to mitigate this risk. Implementing access restrictions to build logs can serve as a temporary measure until the update is applied.
See every vulnerability recorded for org.jenkins-ci.plugins:htmlpublisher →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Versions 425 and earlier of the Jenkins HTML Publisher Plugin are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your pom.xml file, you can check for vulnerabilities without any installation required.
If an immediate update is not possible, restrict access to the Jenkins build logs to minimize the risk of information exposure.
Detailed information about this vulnerability can be found in the advisory database on GitHub, specifically at the link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:htmlpublisher.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
