GitHub Advisoryadvisory · Maven

GHSA-367v-5ppj-2hrx Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs

MEDIUM Published 2025-07-09 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-53651
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:htmlpublisher
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-36, CWE-779
Reviewed
2025-07-09

Affected packages

• Maven org.jenkins-ci.plugins:htmlpublisher: < 427 → fixed in 427

Description

Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log. HTML Publisher Plugin 427 displays only the parent directory name of files archived during the Publish HTML reports post-build step in its log messages.

Related

Alias · CVE (1)

  • CVE-2025-53651 Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish… vulnerability

Weakness · CWE (2)

  • CWE-36 Absolute Path Traversal weakness
  • CWE-779 Logging of Excessive Data weakness

References