8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48920

CVE-2026-48920: Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images to read arbitrary files from the Jenkins controller filesystem.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48920

CVE-2026-48920:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:email-ext	maven	< 1933.1935.v276319e3cc47	1933.1935.v276319e3cc47

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the CssInliner class of the Email Extension Plugin. The process method of this class is used to inline CSS styles and, in vulnerable versions, also to inline images. The image inlining is handled by the inlineImages method.

The inlineImages method iterates over <img> tags that have a data-inline="true" attribute. For each such image, it takes the value of the src attribute and creates a java.net.URL object. The code then opens a connection to this URL, reads the content, and base64-encodes it into a data: URI.

The vulnerability lies in the fact that java.net.URL can handle file: URLs. An attacker can craft an email with an <img> tag like <img src="file:///etc/passwd" data-inline="true">. When the CssInliner processes this, the inlineImages method will read the content of the /etc/passwd file from the Jenkins controller's filesystem and embed it in the email.

The patch for this vulnerability completely removes the inlineImages method and the call to it from the process method, effectively disabling the image inlining feature.

The vulnerable functions that would appear in a runtime profile are hudson.plugins.emailext.plugins.CssInliner.process and hudson.plugins.emailext.plugins.CssInliner.inlineImages. The process method is the public entry point that receives the malicious HTML content, and inlineImages is the private method that contains the vulnerable file-reading logic.

Vulnerable functions

hudson.plugins.emailext.plugins.CssInliner.process

src/main/java/hudson/plugins/emailext/plugins/CssInliner.java

This function processes the email body and, in vulnerable versions, calls the `inlineImages` method which can read arbitrary files from the filesystem.

hudson.plugins.emailext.plugins.CssInliner.inlineImages

src/main/java/hudson/plugins/emailext/plugins/CssInliner.java

This function is responsible for inlining images. It takes a URL from the `src` attribute and fetches its content. It does not validate the URL scheme, allowing `file:` URLs to be used to read local files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.