CVE-2026-48920

[CVE catalog]

A flaw was found in the Jenkins Email Extension Plugin. An attacker with the ability to control email content can exploit this vulnerability by inlining images with `file:` URLs. This allows the attacker to read arbitrary files from the Jenkins controller filesystem, leading to information disclosure. jenkins-email-extension-plugin: Jenkins Email Extension Plugin: Information disclosure via arbitrary file read The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

May 27, 2026, 2:13:48 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.29% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "email_extension",
      "ecosystem": "cpe",
      "fixed_version": ""
    },
    {
      "name": "email_extension",
      "ranges": [],
      "ecosystem": "cpe",
      "fixed_version": "",
      "provider_record_id": "NVD-CVE-2026-48920"
    }
  ]
}