Jenkins HTML Publisher Plugin Absolute Path Information Disclosure Vulnerability

A file path information disclosure vulnerability exists in the Jenkins HTML Publisher Plugin in versions 425 and earlier. The vulnerability arises because the plugin logs absolute paths of files archived during the Publish HTML reports post-build step. This log information can expose details about the Jenkins controller file system, creating a potential security risk.

Impact

Exposing absolute file paths in the Jenkins build log can lead to unauthorized disclosure of the Jenkins controller file system structure, potentially allowing attackers to identify and exploit other vulnerabilities or sensitive information.

Remediation

Users of the Jenkins HTML Publisher Plugin should update to version 427, which addresses this vulnerability by modifying the logged file path information to include only the parent directory name.