CVE-2025-52888: Allure 2 xunit-xml-plugin XXE Vulnerability

CVE-2025-52888 Overview

CVE-2025-52888 is an XML External Entity (XXE) vulnerability in the xunit-xml-plugin used by Allure 2, the version 2.x branch of Allure Report. Allure Report is a multi-language test reporting tool widely adopted in CI/CD pipelines. The plugin fails to securely configure the DocumentBuilderFactory XML parser and allows external entity expansion when processing test result .xml files. Attackers who can supply a crafted test result file can read arbitrary files from the host filesystem and trigger server-side request forgery (SSRF) against internal endpoints. The issue affects all versions prior to 2.34.1 and is tracked under [CWE-611: Improper Restriction of XML External Entity Reference].

Critical Impact
A malicious XML test report processed by Allure 2 can disclose sensitive files such as credentials, CI tokens, and source code, and pivot to internal network resources via SSRF.

Affected Products

Allure 2 (Allure Report) versions prior to 2.34.1
xunit-xml-plugin component bundled with Allure 2
CI/CD pipelines and reporting servers that ingest untrusted xUnit XML test results

Discovery Timeline

2025-06-24 - CVE-2025-52888 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-52888

Vulnerability Analysis

The xunit-xml-plugin parses xUnit-format test result XML files using a Java DocumentBuilderFactory instance that is not hardened against external entity resolution. When the parser encounters a DOCTYPE declaration with an external entity reference, it resolves the entity by reading the referenced URI. An attacker who controls or influences the contents of a test result file can declare entities that point to local files such as /etc/passwd, internal HTTP services, or cloud metadata endpoints like http://169.254.169.254/. The expanded entity content is then incorporated into the parsed document and can be exfiltrated through the report output or through out-of-band channels.

Root Cause

The root cause is the absence of secure parser configuration. The vulnerable code did not disable DTDs or external general and parameter entities through features such as http://apache.org/xml/features/disallow-doctype-decl, external-general-entities, and external-parameter-entities. The patch in commit cbcb3371 introduces a ClasspathEntityResolver that intercepts entity resolution and restricts inputs to known classpath resources, neutralizing arbitrary URI fetches.

Attack Vector

Exploitation requires that an attacker deliver a malicious xUnit XML file to a system running a vulnerable Allure 2 installation. In typical CI/CD workflows this is achievable by submitting a pull request that produces attacker-controlled test artifacts, by uploading a crafted report to a shared reporting service, or by compromising any upstream job whose output feeds Allure aggregation.

java

// Security patch: new ClasspathEntityResolver restricts entity resolution
// Source: https://github.com/allure-framework/allure2/commit/cbcb33719851ff70adce85d38e15d20fc58d4eb7
package io.qameta.allure.parser;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.xml.sax.EntityResolver;
import org.xml.sax.InputSource;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.util.Objects;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
// Resolver constrains external entities to safe classpath sources,
// preventing file:// and http:// exfiltration via XXE.

Source: Allure 2 security patch commit cbcb3371

Detection Methods for CVE-2025-52888

Indicators of Compromise

Test result XML files containing <!DOCTYPE> declarations or <!ENTITY> definitions referencing file://, http://, or https:// URIs.
Outbound network connections from the Allure report generation host to attacker-controlled domains or to cloud metadata addresses such as 169.254.169.254.
Allure-generated reports containing unexpected file system content (for example fragments of /etc/passwd or private keys) embedded in test case fields.
Build logs showing DocumentBuilder activity referencing external URIs during xUnit parsing.

Detection Strategies

Scan repositories and build artifacts for xUnit XML files that contain DOCTYPE or ENTITY declarations, which legitimate test reports rarely require.
Monitor the Allure runtime process for unexpected file reads outside the report input directory and for outbound socket connections to non-allowlisted destinations.
Inventory CI/CD components and flag any host running allure2 at a version earlier than 2.34.1.

Monitoring Recommendations

Enable egress filtering on CI workers and report servers, and alert on any DNS or HTTP traffic generated during report aggregation.
Log all invocations of the Allure CLI and capture the SHA-256 hashes of input XML files for retrospective analysis.
Forward CI/CD audit logs and host telemetry into a centralized analytics platform to correlate suspicious XML inputs with downstream network activity.

How to Mitigate CVE-2025-52888

Immediate Actions Required

Upgrade Allure 2 to version 2.34.1 or later on every host that processes test results.
Audit recent CI/CD runs for malicious xUnit XML inputs and rotate any credentials accessible from build agents that processed untrusted reports.
Restrict who can submit test artifacts to Allure aggregation services, especially from forked pull requests.

Patch Information

The fix is delivered in Allure 2 version 2.34.1 via commit cbcb33719851ff70adce85d38e15d20fc58d4eb7, which introduces a ClasspathEntityResolver and hardens the DocumentBuilderFactory configuration in xunit-xml-plugin. Details are published in the GitHub Security Advisory GHSA-h7qf-qmf3-85qg.

Workarounds

Pre-process xUnit XML files in CI and strip any <!DOCTYPE> or <!ENTITY> declarations before passing them to Allure.
Run Allure report generation in a sandboxed container with no network egress and read-only access limited to the report input directory.
Block outbound connectivity from build agents to internal management endpoints and cloud metadata services.

bash

# Quick check for vulnerable Allure 2 versions and unsafe XML inputs
allure --version
# Upgrade via the official distribution, for example:
#   brew upgrade allure
#   or download the 2.34.1+ release from the Allure GitHub releases page

# Scan test result directories for XXE indicators before report generation
grep -RInE '<!DOCTYPE|<!ENTITY|SYSTEM[[:space:]]+"(file|http|https)://' ./test-results/ \
  && echo "Suspicious XML entity declarations detected - do not run allure generate"