CVE-2025-53651
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-11-04
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | html_publisher | to 427 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-36 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Jenkins HTML Publisher Plugin version 425 and earlier causes the plugin to display log messages that include the absolute paths of files archived during the Publish HTML reports post-build step. This results in exposing information about the Jenkins controller file system within the build log.
How can this vulnerability impact me? :
The vulnerability can lead to unintended exposure of the Jenkins controller's file system structure through build logs. This information disclosure could aid attackers in understanding the environment, potentially facilitating further attacks or exploitation.