CVE-2026-48920: Jenkins Email Extension Plugin Arbitrary File Read via `file:` URLs
Summary
CVE-2026-48920: Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as base64 in email content by setting the data-inline attribute. Affects org.jenkins-ci.plugins:email-ext versions < 1933.1935.v276319e3cc47. Fixed in 1933.1935.v276319e3cc47. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Email Extension Plugin is a widely used tool that enhances Jenkins' email notification capabilities. It allows users to send customized emails with various features, including the ability to inline images using the data-inline attribute. This plugin is integral for teams relying on Jenkins for continuous integration and delivery, providing essential notifications and updates. However, a significant vulnerability exists that can be exploited by attackers to read arbitrary files from the Jenkins controller filesystem.
Vulnerability Detail
The vulnerability arises from the lack of restrictions on image URLs that can be inlined in email content. Specifically, the plugin allows attackers who can control email content to specify file: URLs, enabling them to read sensitive files from the Jenkins controller filesystem. This could lead to unauthorized access to critical information, potentially compromising the entire Jenkins environment. The vulnerability affects versions of the plugin up to 1933.v45cec755423f and has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1933.1935.v276319e3cc47
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the email notifications that utilize the inlining feature until the plugin is updated. This can be done by modifying the email notification settings in your Jenkins job configuration to avoid using the data-inline attribute.
Conclusion
The Jenkins Email Extension Plugin has a critical vulnerability that allows unauthorized file access through the use of file: URLs in email content. It is crucial to update to the patched version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts based on the project's pom.xml.
See every vulnerability recorded for org.jenkins-ci.plugins:email-ext →
FAQ
It is a plugin that enhances Jenkins' email notification capabilities, allowing for customized emails with features like inlining images.
It allows attackers to specify file: URLs in email content, enabling them to read arbitrary files from the Jenkins controller filesystem.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can update the plugin through the Jenkins plugin manager by selecting version 1933.1935.v276319e3cc47 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:email-ext.
