CVE-2026-48920: Jenkins Email Extension Path Traversal

CVE-2026-48920 Overview

CVE-2026-48920 affects the Jenkins Email Extension Plugin, versions 1933.v45cec755423f and earlier. The plugin supports inlining images as base64 in email content by setting the data-inline attribute on image tags. The plugin applies no restrictions on the image URLs used for inlining. Attackers who control email content can specify file: URLs to read arbitrary files from the Jenkins controller filesystem. The flaw is classified under CWE-73 (External Control of File Name or Path).

Critical Impact
Authenticated attackers can exfiltrate arbitrary files from the Jenkins controller, including credentials, secrets, and configuration data, by injecting file: URLs into email templates.

Affected Products

Jenkins Email Extension Plugin 1933.v45cec755423f
Jenkins Email Extension Plugin versions prior to 1933.v45cec755423f
Jenkins controller instances using the affected plugin

Discovery Timeline

2026-05-27 - CVE-2026-48920 published to NVD alongside Jenkins Security Advisory SECURITY-3705
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48920

Vulnerability Analysis

The Email Extension Plugin renders HTML email content and supports an extended data-inline attribute on <img> tags. When this attribute is present, the plugin fetches the referenced image, encodes it as base64, and embeds it inline within the outgoing email body.

The URL handler accepts any scheme supported by the underlying Java URL loader, including file:. Because the plugin does not validate or restrict the scheme, an attacker who controls email body content can request local files. The plugin reads the file, encodes its contents, and includes them in the delivered email, where the attacker can decode and recover the data.

This pattern aligns with CWE-73, where externally supplied input controls a file path used in a privileged operation.

Root Cause

The root cause is missing scheme and path validation in the data-inline image handler. The plugin treats all URL schemes equally and resolves them with the privileges of the Jenkins controller process. No allowlist limits inlined content to http: or https: resources.

Attack Vector

Exploitation requires the ability to influence email content rendered by the plugin. This includes users with permission to configure jobs, edit email templates, or otherwise inject content into the <img> tags processed by Email Extension. An attacker crafts a payload such as <img data-inline="true" src="file:///var/jenkins_home/secrets/master.key"> and triggers an email send. The plugin reads the file from disk and embeds the base64-encoded contents in the delivered message. Sensitive targets on a Jenkins controller include secrets/, credentials.xml, SSH keys, and job configuration files.

No verified public exploit code is available. Refer to the Jenkins Security Advisory SECURITY-3705 for technical details.

Detection Methods for CVE-2026-48920

Indicators of Compromise

Outbound emails from Jenkins containing large base64-encoded <img> payloads not associated with legitimate image assets
Email templates or job configurations containing data-inline attributes paired with file:, jar:file:, or other local-scheme URLs
Access to sensitive controller paths such as $JENKINS_HOME/secrets/ correlated with email send events

Detection Strategies

Audit Jenkins job configurations and Email Extension templates for data-inline attributes referencing non-HTTP schemes
Review the Jenkins controller mail logs and audit-trail plugin output for email events generated by low-privilege users
Inspect outbound SMTP traffic for emails containing unusually large inlined image data

Monitoring Recommendations

Enable file integrity monitoring on $JENKINS_HOME/secrets/ and credential stores to surface unexpected reads
Forward Jenkins system logs and audit-trail events to a centralized log platform for correlation with email transmission
Alert on configuration changes to Email Extension global settings and per-job email templates

How to Mitigate CVE-2026-48920

Immediate Actions Required

Upgrade the Jenkins Email Extension Plugin to a version later than 1933.v45cec755423f as published in Jenkins Security Advisory SECURITY-3705
Restrict Job/Configure and template editing permissions to trusted users until the patch is applied
Review existing email templates and job definitions for data-inline attributes referencing file: URLs and remove them

Patch Information

The Jenkins project addressed the issue in a fixed release of the Email Extension Plugin. Apply the patched version referenced in the Jenkins Security Advisory SECURITY-3705. After upgrading, the plugin restricts inlined images to safe URL schemes.

Workarounds

Limit who can configure jobs and edit email content using Jenkins role-based access control
Run the Jenkins controller under a dedicated service account with least-privilege filesystem permissions over sensitive directories
Disable or remove the Email Extension Plugin if it is not required in your environment

bash

# List installed plugin version and confirm upgrade
jenkins-plugin-cli --list | grep email-ext
jenkins-plugin-cli --plugins email-ext:latest