onyx

onyx --cves cve-2026-48920

CVE-2026-48920

HIGHJenkins
score
<0.1
cvss
8.8
epss
0.5%
published
2026-05-27
kev added
—
first seen

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier contains a path traversal caused by unrestricted inlining of file: URLs in base64 images in email content, letting attackers able to control email content read arbitrary files from the Jenkins controller filesystem, exploit requires attacker control over email content.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-05-27 — PublishedP2026-10-21 — Tracked by OnyxTscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 0.3%2026-09-23: epss 0.3%2026-09-24: epss 0.5%2026-09-25: epss 0.5%2026-09-26: epss 0.5%2026-09-27: epss 0.5%2026-09-29: epss 0.5%2026-09-30: epss 0.5%2026-10-01: epss 0.5%2026-10-02: epss 0.5%2026-10-03: epss 0.5%2026-10-04: epss 0.5%2026-10-05: epss 0.5%2026-10-06: epss 0.5%2026-10-07: epss 0.5%2026-10-08: epss 0.5%2026-10-09: epss 0.5%2026-10-10: epss 0.5%2026-10-11: epss 0.5%2026-10-12: epss 0.5%2026-10-13: epss 0.5%2026-10-14: epss 0.5%2026-10-15: epss 0.5%2026-10-16: epss 0.5%2026-10-18: epss 0.5%2026-10-19: epss 0.5%2026-10-20: epss 0.5%2026-10-21: epss 0.5%0.5%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx

Weaknesses

CWE-73

References 1