CVE-2026-33166

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/allure-framework/allure2/security/advisories/GHSA-64hm-gfwq-jppw	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:qameta:allure_report:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-20 22:16

Updated : 2026-06-17 10:37

NVD link : CVE-2026-33166

Mitre link : CVE-2026-33166

CVE.ORG link : CVE-2026-33166

JSON object : View

Products Affected

qameta

allure_report

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-33166", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33166", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T02:03:48.497897Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "allure-framework", "product": "allure2", "versions": [{"status": "affected", "version": "< 2.38.0"}]}]}], "published": "2026-03-20T22:16:28.660", "references": [{"url": "https://github.com/allure-framework/allure2/security/advisories/GHSA-64hm-gfwq-jppw", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue."}, {"lang": "es", "value": "Allure 2 es la rama 2.x de Allure Report, una herramienta de informes de pruebas multilenguaje. El generador de informes de Allure anterior a la versi\u00f3n 2.38.0 es vulnerable a una lectura de archivo arbitraria mediante salto de ruta al procesar los resultados de las pruebas. Un atacante puede crear un archivo de resultados malicioso (-result.json, -container.json o .plist) que apunte una fuente de adjunto a un archivo sensible en el sistema anfitri\u00f3n. Durante la generaci\u00f3n del informe, Allure resolver\u00e1 estas rutas e incluir\u00e1 los archivos sensibles en el informe final. La versi\u00f3n 2.38.0 corrige el problema."}], "lastModified": "2026-06-17T10:37:03.883", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qameta:allure_report:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7150AE8-CD9B-414E-9DAB-93F8466BEED6", "versionEndExcluding": "2.38.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}