Allure Report HTTP Server Path Traversal (CVE-2026-0548): Arbitrary File Read

Vulnerability Summary: Path Traversal Vulnerability in Allure Report HTTP Server Vulnerability Overview Vulnerability Name: Path traversal in Allure Report HTTP server allowing arbitrary file read CVE ID: CVE-2026-0548 Severity: Medium (CVSS 3.1 score 6.2/10) Root Cause: The built-in HTTP server started by / does not normalize or validate the request URI path. An attacker can include sequences in the request to read any file that the Allure process has permission to access. Scope of Impact Affected Versions: (Maven) - Affected: - Fixed: (Note: The page lists patched versions as 2.38.0 and affected as ; the page is the source of truth) Impact: Any client able to access the HTTP port can exploit this vulnerability to read system files, including: - System credentials ( , SSH private keys, cloud provider credentials) - Application secrets (environment variables in , configuration files, API keys) - Source code and data (deployment scripts and sensitive CI/CD artifacts common in CI/CD environments) POC / Exploitation Code Step 1: Start the Allure server (simulating a typical CI/CD scenario with a network binding): Step 2: Read via path traversal: Step 3: Use percent-encoded traversal (effective even for clients that normalize ): Step 4: Read sensitive application files (e.g., environment variables, SSH keys): Each command returns the contents of the corresponding file that the Allure process can read. Remediation Normalize the resolved path and validate that it remains within the report directory before serving: eliminates sequences, and the check ensures the resolved path remains within the report directory. Requests attempting traversal will receive a 403 Forbidden response.

Goal Reached Thanks to every supporter — we hit 100%!

Allure Report HTTP Server Path Traversal (CVE-2026-0548): Arbitrary File Read

More from this source