Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55846— Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read

Quick assessment

Affected
allure-framework allure2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Allure 2 是 Allure Report（一种多语言测试报告工具）的 2.x 分支。在 2.39.0 之前，由 和 启动的 HTTP 服务器在 的 中使用了 ，并将经过百分号解码的请求路径直接传递给 ，既未对结果进行规范化处理，也未确认该路径是否仍位于指定目录内。 能够访问该服务器的未认证客户端可以通过提交包含父目录（如 ）或百分号编码形式的父目录片段（如 ），从而让 返回任何可被 Allure 进程读取的常规文件。 该服务器默认绑定到 ，但通过 选项可将其暴露给其他系统；因此，本地用户、相邻容器或通过浏览

CVSS 6.2 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55846

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read
Source: CVE Program / CVE List V5
Vulnerability Description
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the percent-decoded request path to reportDirectory.resolve() without normalizing the result or confirming that it remains inside that directory. An unauthenticated client that can reach the server can submit parent-directory segments, including percent-encoded segments, and cause serveFile() to return any regular file readable by the Allure process. The server binds to localhost by default, but the --host option can expose it to other systems, and local users, adjacent containers, or browser-origin attacks may reach a local listener. This can disclose credentials, configuration, source code, build secrets, and other CI/CD data. This issue is fixed in version 2.39.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
allure-framework allure2 < 2.39.0 -

II. Public POCs for CVE-2026-55846

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55846

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55846 (2)

Vendor Advisories for CVE-2026-55846 (1)

Vendor Pages for CVE-2026-55846 (1)

IV. Related Vulnerabilities

Same product: allure2
Same vendor: allure-framework
Same weakness: CWE-22

V. Comments for CVE-2026-55846

No comments yet

Leave a comment