CVE-2024-28151 Jenkins HTML Publisher Plugin Path traversal vulnerability

What is CVE-2024-28151?

CVE-2024-28151 is a medium-severity path traversal vulnerability in Jenkins HTML Publisher Plugin, published on 6 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.

Weakness: CWE-22

Which versions are affected by CVE-2024-28151?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:htmlpublisher. It affects 1 product.

Products include Jenkins Html Publisher.

How do I fix CVE-2024-28151?

Upgrade org.jenkins-ci.plugins:htmlpublisher to 1.32.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-28151 being exploited?

There is no known exploitation of CVE-2024-28151 in the wild and no public exploit code.

Other vulnerabilities in Jenkins HTML Publisher Plugin

• CVE-2026-42524 Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file High 8.0
• CVE-2024-28149 Jenkins HTML Publisher Plugin does not properly sanitize input Medium 6.5
• CVE-2018-1000175 Jenkins HTML Publisher Plugin path traversal vulnerability Medium 6.5
• CVE-2025-53651 Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs Medium 6.3
• CVE-2019-10432 Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-478x-m3mx-7j3f.