CVE-2025-53651 Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs
Attackers can view absolute file system paths in build logs, exposing internal Jenkins controller structure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53651?
CVE-2025-53651 is a medium-severity vulnerability in Jenkins HTML Publisher Plugin, published on 9 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log.
Weakness: CWE-36
Which versions are affected by CVE-2025-53651?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:htmlpublisher. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:htmlpublisher Maven | All versions | 427 |
org.jenkins-ci.plugins:htmlpublisher Maven | All versions | 427 |
Products include Jenkins Html Publisher.
How do I fix CVE-2025-53651?
Upgrade org.jenkins-ci.plugins:htmlpublisher to 427 or later.
Is CVE-2025-53651 being exploited?
There is no known exploitation of CVE-2025-53651 in the wild and no public exploit code.
Other vulnerabilities in Jenkins HTML Publisher Plugin
- CVE-2026-42524 Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file
- CVE-2024-28149 Jenkins HTML Publisher Plugin does not properly sanitize input
- CVE-2018-1000175 Jenkins HTML Publisher Plugin path traversal vulnerability
- CVE-2019-10432 Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting
- CVE-2024-28150 Jenkins HTML Publisher Plugin Stored XSS vulnerability
Sources
Also known as GHSA-367v-5ppj-2hrx.