CVE-2024-28150

CVE-2024-28150 affects Jenkins HTML Publisher Plugin, version 1.32 and earlier. The issue is a stored XSS vulnerability caused by the plugin failing to escape job names, report names, and index page titles shown within the report frame. Exploitation requires attackers to have Item/Configure permi...

CVE-2024-28151

Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, enabling attackers with Item/Configure permission to determine whether a path on the Jenkins controller filesystem exists without accessing it. Affe...

CVE-2025-53651

CVE-2025-53651 affects the Jenkins HTML Publisher Plugin, 425 and earlier. The issue arises because log messages include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller filesystem in build logs. The Connected ...