Cross-site Scripting (XSS)

Overview org.jenkins-ci.plugins:htmlpublisher is a plugin for Jenkins that publishes HTML reports. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the wrapper generation logic in HtmlPublisher. An attacker can inject arbitrary HTML attributes or markup by supplyin...

org.jenkins-ci.plugins:php (1.0) potentially affected by CVE-2026-42524 via org.jenkins-ci.plugins:htmlpublisher (1.0)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - org.jenkins-ci.plugins:php 1.0 Source cves: CVE-2026-42524 Source advisory:...

io.jenkins.blueocean:blueocean (>=1.27.17, <=1.27.26), io.jenkins.blueocean:blueocean-bitbucket-pipeline (>=1.27.17, <=1.27.26) +5 more potentially affected by CVE-2026-42524 via org.jenkins-ci.plugins:htmlpublisher (1.36)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.36 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - io.jenkins.blueocean:blueocean =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.1...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9) potentially affected by CVE-2026-42524 via org.jenkins-ci.plugins:htmlpublisher (1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta, =2.5.9 Source cves: CVE-2026-42524 Source...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), io.jenkins.blueocean:blueocean (>=1.27.17, <=1.27.26) +8 more potentially affected by CVE-2026-42524 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.36)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.0.0, =1.0.18 Source cves: CVE-2026-42524 Source advisory: MEND:CVE-2026-42524...

XSS vulnerability in legacy wrapper file in htmlpublisher

htmlpublisher 427 and earlier does not escape job name and URL in the legacy wrapper file. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. htmlpublisher 427.1 escapes job name and URL when generating the legacy wrapper file...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9) potentially affected by CVE-2025-53651 via org.jenkins-ci.plugins:htmlpublisher (1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta, =2.5.9 Source cves: CVE-2025-53651 Source...

Logging of Excessive Data

Overview org.jenkins-ci.plugins:htmlpublisher is a plugin for Jenkins that publishes HTML reports. Affected versions of this package are vulnerable to Logging of Excessive Data in the publishReports functionality. An attacker can obtain sensitive information about the file system structure by...

org.jenkins-ci.plugins:php (1.0) potentially affected by CVE-2025-53651 via org.jenkins-ci.plugins:htmlpublisher (1.0)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - org.jenkins-ci.plugins:php 1.0 Source cves: CVE-2025-53651 Source advisory:...

io.jenkins.blueocean:blueocean (>=1.27.17, <=1.27.26), io.jenkins.blueocean:blueocean-bitbucket-pipeline (>=1.27.17, <=1.27.26) +5 more potentially affected by CVE-2025-53651 via org.jenkins-ci.plugins:htmlpublisher (1.36)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.36 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - io.jenkins.blueocean:blueocean =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.1...

org.jenkins-ci.plugins:qftest (>=1.0.0, <=1.0.18) potentially affected by CVE-2025-53651 via org.jenkins-ci.plugins:htmlpublisher (1.3)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - org.jenkins-ci.plugins:qftest =1.0.0, =1.0.18 Source cves: CVE-2025-53651 Source advisory...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), io.jenkins.blueocean:blueocean (>=1.27.17, <=1.27.26) +8 more potentially affected by CVE-2025-53651 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.36)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.0.0, =1.0.18 Source cves: CVE-2025-53651 Source advisory: MEND:CVE-2025-53651...

Cross-site Scripting (XSS)

org.jenkins-ci.plugins, htmlpublisher is vulnerable to Cross-Site Scripting. The vulnerability is due to publishReports function within HtmlPublisher.java not having proper input sanitization, This flow allows attackers with Item/Configure permission to inject malicious scripts into job names,...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins:php (1.0) +1 more potentially affected by CVE-2024-28150 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.0.0, =1.0.18 Source cves: CVE-2024-28150 Source advisory: GHSA-XRRW-9J78-HPF3...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins:php (1.0) +1 more potentially affected by CVE-2024-28151 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.0.0, =1.0.18 Source cves: CVE-2024-28151 Source advisory: GHSA-478X-M3MX-7J3F...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins:php (1.0) +1 more potentially affected by CVE-2024-28151 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.0.0, =1.0.18 Source cves: CVE-2024-28151 Source advisory: OSV:GHSA-478X-M3MX-7J3F...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins:php (1.0) +1 more potentially affected by CVE-2024-28150 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.0.0, =1.0.18 Source cves: CVE-2024-28150 Source advisory: OSV:GHSA-XRRW-9J78-HPF3...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins:php (1.0) +1 more potentially affected by CVE-2024-28151 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.0.0, =1.0.18 Source cves: CVE-2024-28151 Source advisory: MEND:CVE-2024-28151...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins:php (1.0) +1 more potentially affected by CVE-2024-28150 via org.jenkins-ci.plugins:htmlpublisher (>=1.0, <=1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0, =1.9.2-beta, =1.0.0, =1.0.18 Source cves: CVE-2024-28150 Source advisory: MEND:CVE-2024-28150...

Stored XSS vulnerability in htmlpublisher

htmlpublisher 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. htmlpublisher 1.32.1 escapes job names, report...