Image Inlining Vulnerability in Jenkins Email Extension Plugin by Jenkins

CVE-2026-48920

What is CVE-2026-48920?

The Jenkins Email Extension Plugin prior to version 1934 allows for the inlining of images as base64 in email content. This feature can be exploited through the data-inline attribute, which does not impose restrictions on the image URLs that can be inlined. As a result, attackers with control over the email content can issue file: URLs, granting them access to read arbitrary files from the Jenkins controller filesystem. This presents a significant security risk, as sensitive information may be exposed to unauthorized parties.

References