CVE-2026-33166: Allure Report Path Traversal Vulnerability

CVE-2026-33166 Overview

CVE-2026-33166 is a Path Traversal vulnerability affecting Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report.

Critical Impact

Attackers can exfiltrate sensitive files from the host system by crafting malicious test result files, potentially exposing credentials, configuration files, private keys, and other confidential data during the report generation process.

Affected Products

• Allure Report 2.x (versions prior to 2.38.0)
• Allure Report Generator (all platforms)
• Systems processing untrusted test result files (-result.json, -container.json, .plist)

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-33166 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33166

Vulnerability Analysis

This vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) allows attackers to read arbitrary files from the host system during the report generation process. The root issue lies in how Allure Report handles attachment source paths specified in test result files without proper validation or sanitization.

When Allure processes test results, it reads attachment paths from result files and resolves them to include the referenced files in the generated report. By exploiting path traversal sequences, an attacker can escape the intended directory boundaries and reference sensitive files anywhere on the filesystem that the Allure process has read access to.

The vulnerability is particularly concerning in CI/CD environments where Allure Report is commonly used to generate test reports. If an attacker can influence the test result files being processed—such as through a compromised test suite, malicious pull request, or supply chain attack—they can extract sensitive files like SSH keys, cloud credentials, database configurations, or application secrets.

Root Cause

The vulnerability stems from insufficient input validation when processing attachment source paths in test result files. The Allure report generator fails to properly sanitize or validate file paths specified in -result.json, -container.json, and .plist files before resolving them on the filesystem. This allows directory traversal sequences (such as ../) to escape the intended working directory and access files outside the expected scope.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker must be able to supply malicious test result files to the Allure report generation process. This can occur through several scenarios:

1. Compromised test suites: Malicious actors with access to test repositories can inject crafted result files
2. Supply chain attacks: Third-party dependencies generating malicious test results
3. CI/CD pipeline exploitation: Attackers exploiting pipeline misconfigurations to inject malicious test artifacts
4. Malicious pull requests: Untrusted contributors submitting test files containing path traversal payloads

The attack exploits the path traversal weakness by specifying attachment sources that traverse outside the intended directory. For example, a malicious result file could reference a path like ../../../etc/passwd or ../../../home/user/.ssh/id_rsa as an attachment source. When Allure generates the report, it reads and includes the contents of these sensitive files, making them accessible to anyone who can view the generated report.

The vulnerability is particularly dangerous because the exfiltrated data appears as legitimate attachments in the generated report, making the attack difficult to detect without specifically auditing the attachment sources in result files.

Detection Methods for CVE-2026-33166

Indicators of Compromise

• Test result files (-result.json, -container.json, .plist) containing path traversal sequences like ../ in attachment source fields
• Generated reports containing unexpected file contents such as system configuration files, credentials, or private keys
• Unusual file access patterns by the Allure report generation process attempting to read files outside the test results directory

Detection Strategies

• Implement file integrity monitoring on directories where test result files are stored to detect unauthorized modifications
• Configure application-level logging to capture file path resolutions during report generation and alert on paths containing traversal sequences
• Deploy endpoint detection and response (EDR) solutions capable of identifying path traversal patterns in file access operations
• Audit generated reports for unexpected attachments containing sensitive file signatures or known credential patterns

Monitoring Recommendations

• Monitor Allure report generation processes for file read operations outside expected directories
• Implement security scanning of test result files before processing, looking for path traversal indicators
• Configure alerts for access attempts to sensitive system files (/etc/passwd, .ssh/, credential files) by report generation processes
• Review CI/CD pipeline logs for anomalous test result file modifications or injections

How to Mitigate CVE-2026-33166

Immediate Actions Required

• Upgrade Allure Report to version 2.38.0 or later immediately
• Audit existing test result files for path traversal sequences in attachment source fields
• Review recently generated reports for potential data exposure
• Implement access controls to restrict which users and processes can submit test result files for report generation

Patch Information

The vulnerability has been addressed in Allure Report version 2.38.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix implements proper path validation and sanitization to prevent directory traversal attacks when processing attachment sources in test result files.

For detailed information about the security fix, see the GitHub Security Advisory.

Workarounds

• Restrict report generation to trusted test result files only—do not process results from untrusted sources
• Implement pre-processing validation that scans test result files for path traversal patterns before allowing Allure to process them
• Run Allure report generation in a sandboxed environment with minimal filesystem access to limit potential data exposure
• Use containerization to isolate the report generation process and mount only necessary directories as read-only volumes

# Example: Run Allure in restricted container environment
docker run --rm \
  --read-only \
  -v /path/to/results:/results:ro \
  -v /path/to/output:/output \
  --security-opt=no-new-privileges \
  allure-docker:2.38.0 generate /results -o /output