Email Extension vulnerabilities

2 known vulnerabilities in Email Extension from Jenkins. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Jenkins Email Extension Plugin: External Control of File Name or Path

  CVE-2026-48920May 27, 2026Jenkins

  Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email c

• 9.9 Critical severity

  Jenkins Email Extension Plugin: Protection Mechanism Failure

  CVE-2023-25765Feb 15, 2023JenkinsEPSS 1.09%

  In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in th