CVE-2026-33166highCWE-22

CVE-2026-33166: falha de alta gravidade em allure-framework allure2

Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar allure2+ Monitorar io.qameta.allure:allure-generator

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.5%
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
allure-framework · allure2
CVEs relacionadas — allure-framework allure2

No mesmo produto, das mais perigosas para as menos.

CVE-2025-52888HIGHAllure 2's xunit-xml-plugin Vulnerable to Improper XXE RestrictionEPSS 0.4%CVE-2026-55847MEDIUMAllure: Stored XSS via unescaped ANSI helper in Allure report status message/trace renderingEPSS 0.3%CVE-2026-55846MEDIUMAllure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File ReadEPSS 0.2%