What is the CVSS score of CVE-2026-33166?

CVE-2026-33166 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-33166?

Within 24 hours: audit all CI/CD pipelines using Allure to identify exposure points, particularly those processing external contributions; disable Allure report generation for untrusted sources if feasible. Within 7 days: implement input validation on test result files before Allure processing, isolate Allure execution in restricted containers with minimal file system access, and rotate any credentials that may have been exposed. Within 30 days: migrate to alternative report generators or establish a secure sandbox environment for Allure execution with strict file system boundaries; monitor for evidence of exploitation in pipeline logs.

Java CVE-2026-33166

HIGH

Path Traversal (CWE-22)

2026-03-18 https://github.com/allure-framework/allure2

GHSA-64hm-gfwq-jppw

Java Information Disclosure Path Traversal Jenkins

8.6

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious test result JSON file
Delivery

Specify sensitive file path in attachment source
Exploit

Upload to Allure report generator
Execution

Path traversal resolves to host system file
Impact

Sensitive file included in generated report

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Attacker must craft malicious test result files (-result.json, -container.json, or .plist) with path traversal payloads in attachment source fields. Allure report generator processes these files during report generation without validation. No authentication or victim interaction required; exploitation occurs during automated test result processing.
Impact	This vulnerability presents high real-world risk with a CVSS score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating network-exploitable with low complexity, no privileges required, and high confidentiality impact with scope change. The availability of a working proof-of-concept significantly elevates practical exploitation risk. In CI/CD contexts (Jenkins, GitHub Actions), this enables credential theft and supply chain compromise through malicious pull requests that trigger automated test report generation. The attack vector is particularly concerning because it exploits legitimate workflow automation rather than requiring direct system access. While EPSS scores are not provided, the combination of low attack complexity, no authentication requirement, functional POC, and high-value targets (CI/CD secrets, cloud credentials) makes this a genuine priority for organizations using Allure in automated pipelines. The scope change aspect indicates the vulnerability can affect resources beyond the vulnerable component itself, amplifying impact in multi-tenant or containerized environments.
Exploit ScenarioDerived	An attacker submits a pull request to a GitHub repository using Allure for test reporting, including a malicious test-result.json file with attachment sources pointing to '../../../../../../../../home/runner/.aws/credentials' and '../../../etc/environment'. When the CI workflow runs and generates the Allure report, these files are copied into the report's attachment directory. The attacker then downloads the published report artifact, extracting AWS credentials and environment variables that provide access to production cloud infrastructure. The attack requires no authentication and succeeds because the CI runner trusts pull request content to generate test reports.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

Path traversal in Allure report generator for Jenkins allows unauthenticated attackers to read arbitrary files from the host system by crafting malicious test result files with specially crafted attachment paths. The vulnerability stems from insufficient path validation when processing attachments during report generation, enabling sensitive files to be included in generated reports. A patch is not currently available.

Earlier versions of this analysis (1)

v1 Mar 18, 2026 - 20:00 CVSS 8.6

A path traversal vulnerability in the Allure report generator allows arbitrary file read through maliciously crafted test result files. An attacker can embed path traversal sequences (e.g., '../../../etc/passwd') in attachment sources within JSON or plist result files, causing Allure to include sensitive files in generated reports. A proof-of-concept exists demonstrating exfiltration of /etc/passwd, and the vulnerability poses significant risk in CI/CD environments where untrusted pull requests trigger report generation with access to secrets and credentials.

RemediationAI

Users should immediately consult the vendor security advisory at https://github.com/allure-framework/allure2/security/advisories/GHSA-64hm-gfwq-jppw for patched versions and upgrade instructions for io.qameta.allure:allure-generator. As interim mitigations until patching is complete, restrict report generation to trusted result files only by implementing input validation before invoking allure generate, isolate report generation processes in sandboxed containers with minimal filesystem access using read-only mounts for sensitive directories, and avoid running Allure generators with elevated privileges or in environments with access to secrets. In CI/CD pipelines processing untrusted pull requests, execute Allure report generation in ephemeral environments without access to production credentials or sensitive configuration files. Organizations using custom Allure web services should immediately disable user upload functionality until the vulnerability is patched.

Affected Packages

maven io.qameta.allure:allure-generator fix: 2.38.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability affects io.qameta.allure:allure-generator (Maven package) and stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The root cause exists in multiple plugin files (Allure2Plugin.java line 264, Allure1Plugin.java line 328, XcTestPlugin.java line 181) where Path.resolve() is called on user-controlled attachment source values without path normalization or validation. Java's Path.resolve() behavior treats absolute paths or paths with traversal sequences literally, allowing escape from the intended allure-results directory. When processing -result.json, -container.json, or .plist files, the generator reads attachment paths directly from these files and resolves them against the filesystem without boundary checks, making any file readable by the Allure process accessible to attackers.

Know when Java gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 18, 2026 - 19:53 nvd

HIGH 8.6

DescriptionGitHub Advisory

Summary

The Allure report generator is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report.

Details

The vulnerability exists in several plugins where attachment paths are resolved using unvalidated user input. The code uses Path.resolve() without normalizing the path or checking if the resulting file remains within the intended results directory.

Affected Files and Lines:

Allure2Plugin.java (Line 264): final Path attachmentFile = source.resolve(attachment.getSource());

Allure1Plugin.java (Line 328): final Path attachmentFile = source.resolve(attachment.getSource());

XcTestPlugin.java (Line 181): attachments.resolve(String.format("Screenshot_%s.%s", uuid, ext))

Since resolve() allows absolute paths or ../ sequences to escape the base directory, any file readable by the process can be exfiltrated.

PoC

Create a directory named allure-results.
Create a file malicious-result.json inside it:

{
  "uuid": "poc-traversal",
  "name": "Path Traversal PoC",
  "status": "passed",
  "attachments": [
    {
      "name": "Sensitive Data",
      "source": "../../../../../../../../../../../etc/passwd",
      "type": "text/plain"
    }
  ]
}

run allure generate allure-results -o allure-report
The content of /etc/passwd will now be present in allure-report/data/attachments/.

Impact

This is a High Severity vulnerability. In CI/CD environments (GitHub Actions, Jenkins), an attacker submitting a Pull Request can exfiltrate server secrets, cloud credentials, or environment configuration files stored on the runner disk. It also may affect custom Allure web services where users can upload results, allowing them to read arbitrary files from the server's filesystem. Allure TestOps is not affected.

Executive ViewAI

Why It Matters

A critical vulnerability in Allure report generation allows attackers to read arbitrary files from systems running the tool, creating a direct threat to sensitive data stored in CI/CD environments. Organizations using Allure to process test results from untrusted sources (such as external pull requests) face immediate risk of credential and secret exposure.

Business Impact: Severe

Compensating Controls

Disable Allure attachment feature or restrict attachment sources to whitelisted, trusted paths only; run Allure in containerized environments with read-only root filesystems and restricted volume mounts; implement network segmentation isolating CI/CD systems from production secrets storage; enforce strict input validation and sanitization of all test result files before processing; use CI/CD platform features to prevent report generation from untrusted pull requests; monitor file access patterns during report generation for anomalous reads.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +43

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.