The Jenkins Ivy Report Plugin up to version 1.2 does not properly configure its XML parser to mitigate XML external entity (XXE) attacks during the processing of Ivy report files. This vulnerability arises because the XML parser accepts external entities, which can be exploited to read local files, perform server-side request forgery, or cause denial of service. The vulnerability is documented as CVE-2026-70448. No CVSS score or vendor advisory with patch information is currently available.

An attacker who can supply or influence Ivy report files processed by the plugin may exploit the XXE vulnerability to access sensitive information, cause denial of service, or perform other unauthorized actions depending on the XML parser's behavior. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted Ivy report files with the affected plugin versions or apply XML parser hardening if possible.