{"id":"CVE-2018-1000175","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-1000175","generatedAt":"2026-10-28T21:27:18.611Z","title":"A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master.","description":"A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master.","published":"2018-05-08T15:29:00.000Z","lastModified":"2026-06-17T01:32:37.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},"cwe":["CWE-22"],"affected":["jenkins/html publisher"],"epss":{"score":0.02663,"percentile":0.85632,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.01046,"percentile":0.62165},{"date":"2026-09-22","score":0.02714,"percentile":0.85358}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.66%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://jenkins.io/security/advisory/2018-04-16/","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://jenkins.io/security/advisory/2018-04-16/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000175","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}