The Jenkins Email Extension Plugin versions up to 1933.v45cec755423f permit inlining images as base64 in email content by setting the data-inline attribute. However, the plugin does not restrict the URLs for these images, allowing an attacker with control over email content to specify file: URLs. This can lead to arbitrary file read from the Jenkins controller filesystem, potentially exposing sensitive data stored on the server. The vulnerability is publicly disclosed but lacks a CVSS score and official remediation details.

An attacker able to control the email content can exploit this vulnerability to read arbitrary files on the Jenkins controller filesystem by leveraging the file: URL scheme in inlined images. This could lead to unauthorized disclosure of sensitive information stored on the Jenkins server. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the Jenkins Project vendor advisory for current remediation guidance. Until a fix is available, restrict who can control email content in Jenkins and monitor for suspicious usage of the Email Extension Plugin. Avoid using vulnerable plugin versions if possible.