8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33166

CVE-2026-33166: Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33166

CVE-2026-33166:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.qameta.allure:allure-generator	maven	<= 2.37.0	2.38.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue present in multiple Allure report generator plugins. The core of the problem lies in the use of java.nio.file.Path.resolve() with unsanitized user input. The user, who provides the test result files (in Allure 1, Allure 2, JUnit XML, or XCTest format), can control the source or filename of attachments. The vulnerable code directly uses this input to build a file path. By providing input like ../../../../../../etc/passwd, an attacker can cause the application to navigate out of the intended results directory and read sensitive files from the filesystem. The patch addresses this by first validating the attachment filename against a strict pattern, then normalizing the path, and finally ensuring that the resolved path is still within the intended parent directory before accessing the file. The analysis of the fixing commit 747badd0bf7ee362fc63771802b18450d1894cdd clearly shows the removal of the vulnerable resolve() calls and the addition of these security checks in Allure1Plugin.java, Allure2Plugin.java, JunitXmlPlugin.java, and XcTestPlugin.java.

Vulnerable functions

io.qameta.allure.allure1.Allure1Plugin.convert

allure-generator/src/main/java/io/qameta/allure/allure1/Allure1Plugin.java

The function `convert` in `Allure1Plugin.java` is vulnerable to path traversal. It uses the `source` of an attachment, which is user-controlled, to resolve a file path using `Path.resolve()`. This method does not validate if the resulting path is within the intended directory, allowing an attacker to craft a malicious `source` (e.g., using `../`) to access arbitrary files on the filesystem.

io.qameta.allure.allure2.Allure2Plugin.convert

allure-generator/src/main/java/io/qameta/allure/allure2/Allure2Plugin.java

The function `convert` in `Allure2Plugin.java` is vulnerable to path traversal. It resolves attachment paths using user-provided data from `attachment.getSource()` without proper sanitization. An attacker can specify a path with traversal sequences (e.g., `../../../../etc/passwd`) to make the application include sensitive files in the generated report.

io.qameta.allure.junitxml.JunitXmlPlugin.getLogFile

plugins/junit-xml-plugin/src/main/java/io/qameta/allure/junitxml/JunitXmlPlugin.java

The `getLogFile` function in `JunitXmlPlugin.java` constructs a file path for log files based on the `className` attribute from a JUnit XML file. Since this `className` can be manipulated by an attacker to include path traversal characters, the call to `resultsDirectory.resolve()` can lead to reading arbitrary files from the host system.

io.qameta.allure.xctest.XcTestPlugin.addScreenshots

plugins/xctest-plugin/src/main/java/io/qameta/allure/xctest/XcTestPlugin.java

The `addScreenshots` function in `XcTestPlugin.java` is vulnerable because it uses a `uuid` from the test results to construct a screenshot's file path. An attacker can provide a malicious `uuid` with path traversal sequences, causing `attachments.resolve()` to access files outside of the intended attachments directory.

io.qameta.allure.xctest.XcTestPlugin.addAttachments

plugins/xctest-plugin/src/main/java/io/qameta/allure/xctest/XcTestPlugin.java

The `addAttachments` function in `XcTestPlugin.java` reads attachment filenames from the XCTest results and resolves them using `attachments.resolve()`. This input is not sanitized, allowing an attacker to specify a filename with path traversal characters (e.g., `../secret.txt`) to read and embed arbitrary files into the Allure report.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.