CVE-2026-48920

High

Published: 27 May 2026

Published

27 May 2026

Modified

28 May 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0030 21.6th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-48920 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Jenkins Email Extension. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-32511

Vulnerability details

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify…

`file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

CWE(s): CWE-73

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Arbitrary file read via file: URLs directly enables collection of data from the local Jenkins controller filesystem.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0