The Jenkins Ivy Report Plugin versions 1.2 and earlier process Ivy report files using an XML parser that is not properly configured to block external entity resolution. A malicious actor can supply a crafted XML file that triggers the parser to access external resources or read internal files, resulting in potential data disclosure. This flaw is a classic XXE weakness (CWE‑611) caused by insufficient parser configuration.

Jenkins Project – Jenkins Ivy Report Plugin, all instances running version 1.2 or earlier are impacted. The vulnerability exists in the Java plug‑in when it parses untrusted Ivy report files and is mitigated by later releases.

The advisory reports no EPSS score and indicates the vulnerability is not listed in CISA KEV, yet the impact is significant if an attacker can supply a malicious Ivy report. The likely attack vector is to upload or influence the Ivy report file through the Jenkins UI or any exposed file endpoint that the plugin processes. No special privileges are required beyond the ability to submit a report file. The CVSS score of 7.1 indicates a high severity vulnerability; the lack of an EPSS score and its absence from the KEV catalog mean the exploitation probability is unknown, but the flaw should be addressed promptly.