CVE-2026-55846
Received Received - Intake

Allure Report Path Traversal Vulnerability

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the percent-decoded request path to reportDirectory.resolve() without normalizing the result or confirming that it remains inside that directory. An unauthenticated client that can reach the server can submit parent-directory segments, including percent-encoded segments, and cause serveFile() to return any regular file readable by the Allure process. The server binds to localhost by default, but the --host option can expose it to other systems, and local users, adjacent containers, or browser-origin attacks may reach a local listener. This can disclose credentials, configuration, source code, build secrets, and other CI/CD data. This issue is fixed in version 2.39.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-55846
EUVD
EUVD-2026-77687

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
qameta allure to 2.39.0 (inc)
qameta allure to 2.39.0 (exc)
qameta allure 2.39.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Allure 2 before version 2.39.0 has a path traversal vulnerability in its HTTP server. The server uses URI.getPath() to handle request paths but does not properly normalize or validate them before resolving file paths. This allows unauthenticated users to submit parent-directory segments, including encoded ones, to access any readable file on the system where Allure is running. The vulnerability exists in the allure serve and allure open commands.

Detection Guidance

Check if Allure 2 is running with a version prior to 2.39.0. Inspect network connections to localhost or configured host for Allure server processes. Look for unexpected file access patterns or unusual file reads in system logs.

Impact Analysis

This vulnerability can allow attackers to read sensitive files on the system running Allure, such as credentials, configuration files, source code, build secrets, and other CI/CD data. If the server is bound to localhost only, local users or adjacent containers could exploit it. If exposed to other systems via the --host option, remote attackers could also access it.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Exposure of credentials or personal data could result in regulatory penalties, data breaches, and loss of trust.

Mitigation Strategies

Upgrade Allure 2 to version 2.39.0 or later. If upgrading is not immediately possible, restrict access to the Allure server by binding it only to localhost and disabling external exposure via the --host option.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart