Jenkins HTML Publisher Plugin path traversal vulnerability

MEDIUM 6.5CVE-2018-1000175 · GHSA-4x63-3p7q-xmh7 · Published 08/05/2018 · updated 17/06/2026

In short

CVE-2018-1000175 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:htmlpublisher, html publisher (jenkins).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.7% of all vulnerabilities.
Fix: update to 1.16 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:htmlpublisher Maven	`< 1.16`	`1.16`
html publisher jenkins	`≤ 1.15`	No fix yet

Description

A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master. In version 1.16, non-alphanumeric characters in report names are escaped for use as part of a URL and as a directory name.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000175 · ADVISORY
jenkinsci/htmlpublisher-plugin · PACKAGE
jenkins.io/security/advisory/2018-04-16 · WEB
jenkins.io/security/advisory/2018-04-16 · Vendor Advisory

More vulnerabilities in org.jenkins-ci.plugins:htmlpublisher

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:htmlpublisher

Maven

< 1.16

1.16

html publisher

jenkins

≤ 1.15

No fix yet

Description

NVD description

More vulnerabilities in org.jenkins-ci.plugins:htmlpublisher

See all →