CVE-2026-33166 - Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)

Back Back to CVE browser

HIGH

Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)

Published Mar 20, 2026

8.6

HIGH

CVSS 3.1

EPSS 0.52%

Description

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.

Affected products

Vendor Allure-Framework Product Allure2 Default
n/a
- Version
  < 2.38.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Allure-Framework

Allure2

n/a

Version	Status	Constraints
< 2.38.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://github.com/advisories/GHSA-64hm-gfwq-jppw
Advisory
https://github.com/allure-framework/allure2/security/advisories/GHSA-64hm-gfwq-jppw
x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33166

Link	Providers	Tags
https://github.com/advisories/GHSA-64hm-gfwq-jppw		Advisory
https://github.com/allure-framework/allure2/security/advisories/GHSA-64hm-gfwq-jppw		x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33166