# CVE-2026-48920: Jenkins Email Extension Plugin arbitrary file read via data-inline attribute

Source: https://junglewise.ai/threats/cve-2026-48920-jenkins-email-extension-plugin-arbitrary-file-read-via-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-48920 · Severity: high · CVSS 8.8 · Published 2026-05-27

The Jenkins Email Extension Plugin, which allows Jenkins to send customized email notifications, contains a security flaw that could allow an attacker to read sensitive files from the Jenkins server. By manipulating email content to include specific file references, an attacker can trick the system into embedding the contents of local system files into emails. This could lead to the exposure of configuration data, credentials, or other private information stored on the Jenkins controller.

Technologies: [org.jenkins-ci.plugins:email-ext (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-email-ext). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-48920 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48920 being exploited in the wild.

**How severe is CVE-2026-48920?** High severity, with a CVSS score of 8.8, published 27 May 2026.

**Which products and versions are affected?** Jenkins Email Extension Plugin 1933.v45cec755423f and earlier; org.jenkins-ci.plugins:email-ext (Maven) < 1933.1935.v276319e3cc47, ECOSYSTEM:introduced=0,fixed=1933.1935.v276319e3cc47.

**Is there a fix for CVE-2026-48920?** Yes. org.jenkins-ci.plugins:email-ext (Maven): upgrade to 1933.1935.v276319e3cc47 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48920 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48920?** Check whether you run Jenkins Email Extension Plugin or org.jenkins-ci.plugins:email-ext (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:email-ext (Maven): upgrade to 1933.1935.v276319e3cc47 or later

  ```sh
  # set org.jenkins-ci.plugins:email-ext to 1933.1935.v276319e3cc47 in your pom.xml or build.gradle
  ```


## Technical details

The Jenkins Email Extension Plugin (up to version 1933.v45cec755423f) contains an arbitrary file read vulnerability classified under CWE-73 (External Control of File Name or Path). The plugin includes a feature that inlines images as base64 data in emails when the 'data-inline' attribute is present; however, it lacks validation or restrictions on the source URLs provided. A remote attacker with low privileges (sufficient to control or influence email content) can specify 'file:' URIs to reference arbitrary files on the Jenkins controller's filesystem. The plugin then reads these files and embeds their content into the generated email. The fix, introduced in version 1933.1935.v276319e3cc47, completely removes the vulnerable inlining feature.

## Affected products

- Jenkins Email Extension Plugin 1933.v45cec755423f and earlier

## Identifiers

- CVE-2026-48920
- GHSA-mq58-m26g-46gp

## Timeline

- 2026-05-27: advisory: Initial advisory published by Jenkins and GitHub
- 2026-05-27: patched: Fixed in version 1933.1935.v276319e3cc47

## References

- [https://www.jenkins.io/security/advisory/2026-05-27/](https://www.jenkins.io/security/advisory/2026-05-27/)

## Related threats

- [Jenkins Email Extension Plugin Cross-Site Request Forgery vulnerability](https://junglewise.ai/threats/cve-2023-32980-jenkins-email-extension-plugin-cross-site-request-forgery)
- [Jenkins Email Extension Plugin missing permission check](https://junglewise.ai/threats/cve-2023-32979-jenkins-email-extension-plugin-missing-permission-check)
- [Cross-site Scripting in Jenkins Email Extension Plugin](https://junglewise.ai/threats/cve-2023-25764-cross-site-scripting-in-jenkins-email-extension-plugin)
- [Cross-site Scripting in Jenkins Email Extension Plugin](https://junglewise.ai/threats/cve-2023-25763-cross-site-scripting-in-jenkins-email-extension-plugin)
- [Sandbox escape in Jenkins Email Extension Plugin](https://junglewise.ai/threats/cve-2023-25765-sandbox-escape-in-jenkins-email-extension-plugin)