Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.jenkins-ci.plugins:htmlpublisher

7 known vulnerabilities (1 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 high, 4 medium
Dependents
0
Registry
Maven Central

Advisories 7

  • Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored…

    Affected: fixed in 427.1.

  • CVE-2025-53651Medium 6.3

    Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish…

    Affected: fixed in 427.

  • CVE-2024-28151Medium 4.3

    Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the…

    Affected: fixed in 1.32.1.

  • CVE-2024-28150Medium 4.7

    Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report…

    Affected: fixed in 1.32.1.

  • CVE-2024-28149Medium 6.5

    Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure…

    Affected: from 1.16, fixed in 1.32.1.

  • Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a…

    Affected: fixed in 1.21.

  • A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers…

    Affected: fixed in 1.16.