Read the docs
TI-2026-25596 Aliases CVE-2026-33166GHSA-64hm-gfwq-jppw

Path traversal in allure-framework allure2

Priority HIGH 76CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed allure2 (allure-framework): 2.38.0io.qameta.allure:allure-generator (Maven): 2.38.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
allure-frameworkallure2before 2.38.02.38.0Patch availableCNA
—io.qameta.allure:allure-generator (Maven)before 2.38.02.38.0Patch availableGHSA-64hm-gfwq-jppw
  • allure2 Vendorallure-framework Affected before 2.38.0 Fixed in 2.38.0 Patch available CNA
  • io.qameta.allure:allure-generator (Maven) Vendor— Affected before 2.38.0 Fixed in 2.38.0 Patch available GHSA-64hm-gfwq-jppw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:qameta:allure_report:*:*:*:*:*:*:*:*before 2.38.0VulnerableQameta
  • cpe:2.3:a:qameta:allure_report:*:*:*:*:*:*:*:* Versions before 2.38.0 Vulnerable ·Qameta

Remediation

  • Fix · CNA allure2 (allure-framework) Fixed in 2.38.0
  • Fix · GHSA-64hm-gfwq-jppw io.qameta.allure:allure-generator (Maven) Fixed in 2.38.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33166
  2. 2026-10-03 Alias added: GHSA-64hm-gfwq-jppw

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-32924 Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction CVSS 3.1HIGH 7.5
  • TI-2026-40308 Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read CVSS 3.1MEDIUM 6.2
  • TI-2026-40309 Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences