CVE-2025-52888: falha de alta gravidade em allure-framework allure2
Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.4%
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
allure-framework · allure2CVEs relacionadas — allure-framework allure2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33166HIGHAllure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)EPSS 0.5%CVE-2026-55847MEDIUMAllure: Stored XSS via unescaped ANSI helper in Allure report status message/trace renderingEPSS 0.3%CVE-2026-55846MEDIUMAllure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File ReadEPSS 0.2%