Read the docs
TI-2025-32924 Aliases CVE-2025-52888GHSA-h7qf-qmf3-85qg

Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction

Priority HIGH 72CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Fix Fixed allure2 (allure-framework): 2.34.1io.qameta.allure.plugins:xunit-xml-plugin (Maven): 2.34.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
allure-frameworkallure2before 2.34.12.34.1Patch availableCNA
—io.qameta.allure.plugins:xunit-xml-plugin (Maven)before 2.34.12.34.1Patch availableGHSA-h7qf-qmf3-85qg
—io.qameta.allure.plugins:junit-xml-plugin (Maven)before 2.34.12.34.1Patch availableGHSA-h7qf-qmf3-85qg
—io.qameta.allure.plugins:trx-plugin (Maven)before 2.34.12.34.1Patch availableGHSA-h7qf-qmf3-85qg
  • allure2 Vendorallure-framework Affected before 2.34.1 Fixed in 2.34.1 Patch available CNA
  • io.qameta.allure.plugins:xunit-xml-plugin (Maven) Vendor— Affected before 2.34.1 Fixed in 2.34.1 Patch available GHSA-h7qf-qmf3-85qg
  • io.qameta.allure.plugins:junit-xml-plugin (Maven) Vendor— Affected before 2.34.1 Fixed in 2.34.1 Patch available GHSA-h7qf-qmf3-85qg
  • io.qameta.allure.plugins:trx-plugin (Maven) Vendor— Affected before 2.34.1 Fixed in 2.34.1 Patch available GHSA-h7qf-qmf3-85qg

Remediation

  • Fix · CNA allure2 (allure-framework) Fixed in 2.34.1
  • Fix · GHSA-h7qf-qmf3-85qg io.qameta.allure.plugins:xunit-xml-plugin (Maven) Fixed in 2.34.1 Advisory →
  • Fix · GHSA-h7qf-qmf3-85qg io.qameta.allure.plugins:junit-xml-plugin (Maven) Fixed in 2.34.1 Advisory →
  • Fix · GHSA-h7qf-qmf3-85qg io.qameta.allure.plugins:trx-plugin (Maven) Fixed in 2.34.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52888
  2. 2026-10-03 Alias added: GHSA-h7qf-qmf3-85qg

References

Advisory 1

Other 3

  • TI-2026-40308 Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read CVSS 3.1MEDIUM 6.2
  • TI-2026-40309 Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences