Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log.
https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3547