Information Disclosure in Jenkins HTML Publisher Plugin by Jenkins

CVE-2025-53651

What is CVE-2025-53651?

The HTML Publisher Plugin for Jenkins prior to version 426 exposes sensitive information by logging absolute file paths of archived items during the post-build report generation process. This information can lead to unauthorized access to the Jenkins controller's file system, potentially allowing malicious actors to exploit this data for further attacks.

References