CVE-2018-1000175 Jenkins HTML Publisher Plugin path traversal vulnerability
Attackers with build configuration access can override arbitrary files on the Jenkins master via path traversal in the HTML Publisher plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000175?
CVE-2018-1000175 is a medium-severity path traversal vulnerability in n/a, published on 8 May 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master.
Weakness: CWE-22
Which versions are affected by CVE-2018-1000175?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:htmlpublisher. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:htmlpublisher Maven | All versions | 1.16 |
org.jenkins-ci.plugins:htmlpublisher Maven | All versions | 1.16 |
Products include Jenkins Html Publisher.
How do I fix CVE-2018-1000175?
Upgrade org.jenkins-ci.plugins:htmlpublisher to 1.16 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1000175 being exploited?
There is no known exploitation of CVE-2018-1000175 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-42524 Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file
- CVE-2024-28149 Jenkins HTML Publisher Plugin does not properly sanitize input
- CVE-2025-53651 Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs
- CVE-2019-10432 Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting
- CVE-2024-28150 Jenkins HTML Publisher Plugin Stored XSS vulnerability
Sources
Also known as GHSA-4x63-3p7q-xmh7.