CVE-2026-48920

High

Advisory

Published 27 May 2026In the index since 8 Sept 2026

Severity: High; worst across findings
CVSS: 8.8; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1; of 17,781 indexed, latest versions
Container images: 1; deployed by those charts
Fix available: 1 of 1; affected package

Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

Carried by container images the latest versions of 1 of 17,781 indexed charts deploy, on 1 image.

Affected package	Affected versions	Fixed in	Images
email-extmaven	1844.v3ea_a_b_842374a_	1933.1935.v276319e3cc47	1

OSV records: GHSA-mq58-m26g-46gp

Charts affected

1 by stars

Chart

Latest

Affected images

Radar Score

my-bloody-jenkinsodavid

0.1.218

1 of 1 See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2026-48920.

Container image	Digest	Package	Fixed in
odavid/my-bloody-jenkins :2.462.3-306	e7ab3bbc948e	email-ext@1844.v3ea_a_b_842374a_	1933.1935.v276319e3cc47

Open the chart page →

5,826

Container images carrying it

1 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
odavid/my-bloody-jenkins :2.462.3-306	e7ab3bbc948e	email-ext@1844.v3ea_a_b_842374a_	1933.1935.v276319e3cc47	1