High · 7.1 CVE-2026-70448 EUVD-2026-53542GHSA-64jg-65j7-rrm4

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Iv…

Published Aug 5, 2026 · Updated Aug 5, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Ivy Report Plugin Category: Web / CMS

Description

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins Ivy Report Plugin	≤ 1.2	—

Advisories 1

WID-SEC-2026-2665 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026

References

Jenkins Security Advisory 2026-08-05 vendor-advisory