CVE-2026-33166: Allure Report Path Traversal Vulnerability

CVE-2026-33166 Overview

CVE-2026-33166 is a Path Traversal vulnerability affecting Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report.

Critical Impact
Attackers can exfiltrate sensitive files from the host system by crafting malicious test result files, potentially exposing credentials, configuration files, private keys, and other confidential data during the report generation process.

Affected Products

Allure Report 2.x (versions prior to 2.38.0)
Allure Report Generator (all platforms)
Systems processing untrusted test result files (-result.json, -container.json, .plist)

Discovery Timeline

2026-03-20 - CVE CVE-2026-33166 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33166

Vulnerability Analysis

This vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) allows attackers to read arbitrary files from the host system during the report generation process. The root issue lies in how Allure Report handles attachment source paths specified in test result files without proper validation or sanitization.

When Allure processes test results, it reads attachment paths from result files and resolves them to include the referenced files in the generated report. By exploiting path traversal sequences, an attacker can escape the intended directory boundaries and reference sensitive files anywhere on the filesystem that the Allure process has read access to.

The vulnerability is particularly concerning in CI/CD environments where Allure Report is commonly used to generate test reports. If an attacker can influence the test result files being processed—such as through a compromised test suite, malicious pull request, or supply chain attack—they can extract sensitive files like SSH keys, cloud credentials, database configurations, or application secrets.

Root Cause

The vulnerability stems from insufficient input validation when processing attachment source paths in test result files. The Allure report generator fails to properly sanitize or validate file paths specified in -result.json, -container.json, and .plist files before resolving them on the filesystem. This allows directory traversal sequences (such as ../) to escape the intended working directory and access files outside the expected scope.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker must be able to supply malicious test result files to the Allure report generation process. This can occur through several scenarios:

Compromised test suites: Malicious actors with access to test repositories can inject crafted result files
Supply chain attacks: Third-party dependencies generating malicious test results
CI/CD pipeline exploitation: Attackers exploiting pipeline misconfigurations to inject malicious test artifacts
Malicious pull requests: Untrusted contributors submitting test files containing path traversal payloads

The attack exploits the path traversal weakness by specifying attachment sources that traverse outside the intended directory. For example, a malicious result file could reference a path like ../../../etc/passwd or ../../../home/user/.ssh/id_rsa as an attachment source. When Allure generates the report, it reads and includes the contents of these sensitive files, making them accessible to anyone who can view the generated report.

The vulnerability is particularly dangerous because the exfiltrated data appears as legitimate attachments in the generated report, making the attack difficult to detect without specifically auditing the attachment sources in result files.

Detection Methods for CVE-2026-33166

Indicators of Compromise

Test result files (-result.json, -container.json, .plist) containing path traversal sequences like ../ in attachment source fields
Generated reports containing unexpected file contents such as system configuration files, credentials, or private keys
Unusual file access patterns by the Allure report generation process attempting to read files outside the test results directory

Detection Strategies

Implement file integrity monitoring on directories where test result files are stored to detect unauthorized modifications
Configure application-level logging to capture file path resolutions during report generation and alert on paths containing traversal sequences
Deploy endpoint detection and response (EDR) solutions capable of identifying path traversal patterns in file access operations
Audit generated reports for unexpected attachments containing sensitive file signatures or known credential patterns

Monitoring Recommendations

Monitor Allure report generation processes for file read operations outside expected directories
Implement security scanning of test result files before processing, looking for path traversal indicators
Configure alerts for access attempts to sensitive system files (/etc/passwd, .ssh/, credential files) by report generation processes
Review CI/CD pipeline logs for anomalous test result file modifications or injections

How to Mitigate CVE-2026-33166

Immediate Actions Required

Upgrade Allure Report to version 2.38.0 or later immediately
Audit existing test result files for path traversal sequences in attachment source fields
Review recently generated reports for potential data exposure
Implement access controls to restrict which users and processes can submit test result files for report generation

Patch Information

The vulnerability has been addressed in Allure Report version 2.38.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix implements proper path validation and sanitization to prevent directory traversal attacks when processing attachment sources in test result files.

For detailed information about the security fix, see the GitHub Security Advisory.

Workarounds

Restrict report generation to trusted test result files only—do not process results from untrusted sources
Implement pre-processing validation that scans test result files for path traversal patterns before allowing Allure to process them
Run Allure report generation in a sandboxed environment with minimal filesystem access to limit potential data exposure
Use containerization to isolate the report generation process and mount only necessary directories as read-only volumes

bash

# Example: Run Allure in restricted container environment
docker run --rm \
  --read-only \
  -v /path/to/results:/results:ro \
  -v /path/to/output:/output \
  --security-opt=no-new-privileges \
  allure-docker:2.38.0 generate /results -o /output