Jenkins Project Jenkins HTML Publisher Plugin vulnerabilities

6 vulnerabilities

Known vulnerabilities in Jenkins Project Jenkins HTML Publisher Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.3CVE-2025-53651jenkins projectjenkins html publisher plugin+2
EPSS score
0.51%
Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log.6.5CVE-2024-28149jenkins projectjenkins html publisher plugin+2
EPSS score
0.70%
Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.4.7CVE-2024-28150jenkins projectjenkins html publisher plugin+2
EPSS score
0.68%
Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.4.3CVE-2024-28151jenkins projectjenkins html publisher plugin+2
EPSS score
0.94%
Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.5.4CVE-2019-10432jenkins projectjenkins html publisher plugin+2
EPSS score
1.18%
Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those.8CVE-2026-42524jenkins projectjenkins html publisher plugin+2
EPSS score
0.50%
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.