{"id":"CVE-2026-48920","details":"Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.","aliases":["GHSA-mq58-m26g-46gp"],"modified":"2026-07-15T06:10:15.604969Z","published":"2026-05-27T15:16:31.647Z","references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3705"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/email-ext-plugin","events":[{"introduced":"0"},{"last_affected":"1598902b58ddfa69d5763b62db609f864f57e2d8"},{"introduced":"45cec755423fcd203c6dc643794e6da6b6d66fb9"},{"last_affected":"45cec755423fcd203c6dc643794e6da6b6d66fb9"}],"database_specific":{"cpe":["cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:email_extension:1933.v45cec755423f:*:*:*:*:jenkins:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"1925.v1598902b_58dd"},{"introduced":"1933.v45cec755423f"},{"last_affected":"1933.v45cec755423f"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["1933.v45cec755423f","1925.v1598902b_58dd","1922.v5c93c9e80a_f9","1916.vc954a_f86ff21","1911.v19b_8e86f9815","1876.v28d8d38315b_d","1866.v14fa_6d201654","1861.vdb_d991590994","1855.vd9e491cb_de1e","1851.v2b_5345e6272d","1849.v6dd03b_f6e423","1844.v3ea_a_b_842374a_","1814.v404722f34263","1806.v856a_01a_fa_39a_","email-ext-2.105","email-ext-2.104","email-ext-2.103","email-ext-2.102","email-ext-2.101","email-ext-2.100","email-ext-2.99","email-ext-2.98","email-ext-2.97","email-ext-2.96","email-ext-2.95","email-ext-2.93","email-ext-2.92","email-ext-2.91","email-ext-2.90","email-ext-2.89","email-ext-2.88","email-ext-2.87","email-ext-2.86","email-ext-2.85","email-ext-2.84","email-ext-2.83","email-ext-2.82","email-ext-2.81","email-ext-2.80","email-ext-2.79","email-ext-2.78","email-ext-2.77","email-ext-2.76","email-ext-2.75","email-ext-2.74","email-ext-2.73","email-ext-2.72","email-ext-2.71","email-ext-2.69","email-ext-2.68","email-ext-2.67","email-ext-2.66","email-ext-2.65","email-ext-2.64","email-ext-2.63","email-ext-2.62","email-ext-2.61","email-ext-2.60","email-ext-2.59","email-ext-2.58","email-ext-2.57","email-ext-2.56","email-ext-2.55","email-ext-2.52","email-ext-2.51","email-ext-2.50","email-ext-2.49","email-ext-2.48","email-ext-2.47","email-ext-2.46","email-ext-2.45","email-ext-2.44","email-ext-2.43","email-ext-2.42","email-ext-2.41.2","email-ext-2.41","email-ext-2.40.2","email-ext-2.40","email-ext-2.39","email-ext-2.37.2","email-ext-2.37.1","email-ext-2.37","email-ext-2.35.1","email-ext-2.35","email-ext-2.34","email-ext-2.33","email-ext-2.32","email-ext-2.31","email-ext-2.30.2","email-ext-2.30.1","email-ext-2.30","email-ext-2.29","email-ext-2.27.1","email-ext-2.27","email-ext-2.25","email-ext-2.24.1","email-ext-2.24","email-ext-2.22","email-ext-2.21","email-ext-2.20","email-ext-2.19","email-ext-2.18","email-ext-2.17","email-ext-2.16","email-ext-2.15","email-ext-2.14","email-ext-2.13","email-ext-2.12","email-ext-2.11"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48920.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}