CVE-2024-28150

The Jenkins HTML Publisher Plugin (version 1.32 and earlier ) is vulnerable to stored cross-site scripting (XSS) . The root cause is a lack of proper input sanitization and escaping for job names , report names , and index page titles displayed within the report frame. Specifically, the publishRe...

CVE-2024-28151

The Jenkins HTML Publisher Plugin (version 1.32 and earlier ) is vulnerable to a Path Traversal flaw. The root cause is the improper archiving of invalid symbolic links in report directories on agents and their subsequent recreation on the Jenkins controller. This oversight allows attackers with ...

CVE-2025-53651

The Jenkins HTML Publisher Plugin (version 425 and earlier ) is vulnerable to an information disclosure flaw in its publishReports functionality. The plugin displays log messages containing the absolute paths of files archived during the Publish HTML reports post-build step. This allows an attack...