CVE-2021-21642: Jenkins Config File Provider

High severity, CVSS 8.1. EPSS: 37.8% chance of exploitation in the next 30 days.

Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

• Jenkins Config File Provider: up to and including 3.7.0

Published 2021-04-21. Last modified 2026-06-17.