Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email
    content by setting the `data-inline` attribute, without restrictions on the image URLs that can be
    inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read
    arbitrary files from the Jenkins controller filesystem. (CVE-2026-48920)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-     site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or views.
    (CVE-2026-48927)

  - Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email     content by setting the `data-inline` attribute, without restrictions on the image URLs that can be     inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read     arbitrary files from the Jenkins controller filesystem. (CVE-2026-48920)

  - Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. (CVE-2026-48916)

  - Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without     validation. (CVE-2026-48917)

  - Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. (CVE-2026-48918)

  - Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.
    (CVE-2026-48919)

  - Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic     links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline     job to read arbitrary files on the Jenkins controller filesystem. (CVE-2026-48921)

  - Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names     for file and zip file credentials, allowing attackers able to provide credentials to a job to write files     to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is     configured to allow a low-privileged user to configure file or zip file credentials used for a job running     on the built-in node. (CVE-2026-48922)

  - Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing     form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
    (CVE-2026-48923)

  - Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing     attackers to perform phishing attacks. (CVE-2026-48924)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier     allows attackers to attackers to trigger a build for a pull request. (CVE-2026-48925)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and     earlier allows attackers to resume failed Multijob builds. (CVE-2026-9674)

  - Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP     endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials     stored in Jenkins. (CVE-2026-48926)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
444284	SCA: security update for org.jenkins-ci.plugins:email-ext (GHSA-mq58-m26g-46gp)	Tenable Cloud Security	SCA Checks	Local	high
444284	SCA: security update for org.jenkins-ci.plugins:email-ext (GHSA-mq58-m26g-46gp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
317047	Jenkins plugins Multiple Vulnerabilities (2026-05-27)	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2026-48920

high

Tenable Plugins

high

high

high