CVE-2026-48920: Jenkins Email Extension Plugin 1933

Synopsis

This is a server-side request forgery-class file read vulnerability in the Jenkins Email Extension Plugin (versions up to and including 1933.v45cec755423f). An attacker with enough access to control email content in Jenkins can specify file: URLs in the data-inline attribute of inlined images, causing the Jenkins controller to read arbitrary files from its own filesystem and embed them in outgoing emails. Successful exploitation gives the attacker read access to any file the Jenkins process can open, including credentials, configuration files, and secrets stored on the controller. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Jenkins instance over the network; the plugin endpoint is exposed via the standard Jenkins web interface.

• AuthenticationRequired

  Any low-privilege Jenkins account with permission to influence email content (for example, through job configuration or pipeline scripts) is sufficient to trigger the file read.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the file read directly by submitting crafted email content.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker only needs to supply a file: URL as the image source, with no race conditions or environmental dependencies.

Blast Radius

• Reads arbitrary files from the Jenkins controller filesystem that the Jenkins process has permission to open, including credentials.xml, secrets directories, and API token stores.
• Embeds the raw file contents into outgoing emails, exfiltrating sensitive data to any email address the attacker can route the notification to.
• Exposes SSH private keys, cloud provider credentials, or other secrets stored on the controller, enabling lateral movement into downstream infrastructure.
• Leaks Jenkins internal configuration that can reveal user account details, plugin configurations, and connected system endpoints.