{"id":"CVE-2026-55846","state":"PUBLISHED","title":"Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read","description":"Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the percent-decoded request path to reportDirectory.resolve() without normalizing the result or confirming that it remains inside that directory. An unauthenticated client that can reach the server can submit parent-directory segments, including percent-encoded segments, and cause serveFile() to return any regular file readable by the Allure process. The server binds to localhost by default, but the --host option can expose it to other systems, and local users, adjacent containers, or browser-origin attacks may reach a local listener. This can disclose credentials, configuration, source code, build secrets, and other CI/CD data. This issue is fixed in version 2.39.0.","publishedAt":"2026-09-14T17:20:49.131Z","updatedAt":"2026-09-16T15:23:53.025Z","severity":{"score":6.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["allure-framework allure2"],"affected":[{"vendor":"allure-framework","product":"allure2","versions":[{"version":"< 2.39.0","status":"affected"}]}],"references":["https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc","https://github.com/allure-framework/allure2/pull/3288","https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced","https://github.com/allure-framework/allure2/releases/tag/2.39.0"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/55xxx/CVE-2026-55846.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-55846","state":"PUBLISHED","datePublished":"2026-09-14T17:20:49.131Z","dateUpdated":"2026-09-16T15:23:53.025Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-06-17T16:29:38.865Z"},"containers":{"cna":{"title":"Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read","descriptions":[{"lang":"en","value":"Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the percent-decoded request path to reportDirectory.resolve() without normalizing the result or confirming that it remains inside that directory. An unauthenticated client that can reach the server can submit parent-directory segments, including percent-encoded segments, and cause serveFile() to return any regular file readable by the Allure process. The server binds to localhost by default, but the --host option can expose it to other systems, and local users, adjacent containers, or browser-origin attacks may reach a local listener. This can disclose credentials, configuration, source code, build secrets, and other CI/CD data. This issue is fixed in version 2.39.0."}],"affected":[{"vendor":"allure-framework","product":"allure2","versions":[{"version":"< 2.39.0","status":"affected"}]}],"references":[{"url":"https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc","name":"https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/allure-framework/allure2/pull/3288","name":"https://github.com/allure-framework/allure2/pull/3288","tags":["x_refsource_MISC"]},{"url":"https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced","name":"https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced","tags":["x_refsource_MISC"]},{"url":"https://github.com/allure-framework/allure2/releases/tag/2.39.0","name":"https://github.com/allure-framework/allure2/releases/tag/2.39.0","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-09-14T17:20:49.131Z"},"source":{"advisory":"GHSA-82cg-3hv7-74gc","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-16T15:23:28.166608Z","id":"CVE-2026-55846","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-16T15:23:53.025Z"}}]}}}