Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs

MEDIO 6.3CVE-2025-53651 · GHSA-367v-5ppj-2hrx · Published 09/07/2025 · updated 17/06/2026

In breve

CVE-2025-53651 è una vulnerabilità MEDIO (CVSS 6.3) che riguarda org.jenkins-ci.plugins:htmlpublisher, html publisher (jenkins).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.51%, superiore al 43.2% delle vulnerabilità.
Correzione: aggiornare a 427 o successiva.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:htmlpublisher Maven	`< 427`	`427`
html publisher jenkins	`< 427`	`427`

Description

Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log.

HTML Publisher Plugin 427 displays only the parent directory name of files archived during the Publish HTML reports post-build step in its log messages.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-53651 · ADVISORY
jenkinsci/htmlpublisher-plugin · PACKAGE
jenkins.io/security/advisory/2025-07-09 · WEB
openwall.com/lists/oss-security/2025/07/09/4 · WEB

Altre vulnerabilità di org.jenkins-ci.plugins:htmlpublisher

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:htmlpublisher

Maven

< 427

427

html publisher

jenkins

< 427

427

Description

HTML Publisher Plugin 427 displays only the parent directory name of files archived during the Publish HTML reports post-build step in its log messages.

NVD description

Altre vulnerabilità di org.jenkins-ci.plugins:htmlpublisher

Vedi tutto →