PT-2026-26203 · Allure · Allure

Thanostsiamis

·

Published

2026-03-18

·

Updated

2026-03-21

·

CVE-2026-33166

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Allure versions prior to 2.38.0
Description The Allure report generator is susceptible to an arbitrary file read due to a path traversal issue when processing test results. An attacker can create a malicious result file (such as -result.json, -container.json, or .plist) that references an attachment source pointing to a sensitive file on the host system. During report generation, Allure resolves these paths, potentially including sensitive files in the final report. The issue stems from unvalidated user input used in resolving attachment paths, specifically within functions like Path.resolve() which doesn't normalize the path or verify it remains within the intended results directory. This could allow an attacker to exfiltrate server secrets, cloud credentials, or environment configuration files in CI/CD environments or custom Allure web services. The vulnerable files include Allure2Plugin.java (Line 264), Allure1Plugin.java (Line 328), and XcTestPlugin.java (Line 181). The resolve() function allows absolute paths or "../" sequences to escape the base directory, enabling access to any readable file.
Recommendations Versions prior to 2.38.0 should be updated to version 2.38.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-33166
GHSA-64HM-GFWQ-JPPW

Affected Products

Allure