---
id: CVE-2026-48920
title: >-
  Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining
  images as `base64` in email content by setting the `data-inline` attribute,
  without restrictions on the image URLs that can be inlined, allowing attackers
  able…
summary: >-
  Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining
  images as `base64` in email content by setting the `data-inline` attribute,
  without restrictions on the image URLs that can be inlined, allowing attackers
  able…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-73
vendor: jenkins
product: email_extension
affected:
  - email_extension <= 1925.v1598902b_58dd
  - email_extension = 1933.v45cec755423f
published: '2026-05-27'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48920'
references:
  - url: 'https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3705'
    label: jenkinsci-cert@googlegroups.com
tags:
  - nvd
epss: 0.00509
epssPercentile: 0.41996
ingestedAt: '2026-10-14T20:53:12.324Z'
---

## Overview

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

## Affected

- `email_extension <= 1925.v1598902b_58dd`
- `email_extension = 1933.v45cec755423f`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.