What is the CVSS score of EUVD-2025-19057?

EUVD-2025-19057 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Java are affected by EUVD-2025-19057?

Allure 2 versions prior to 2.34.1 contain an XML parsing vulnerability that could allow attackers to read sensitive files from affected systems and potentially access internal network resources.. A patch is available.

How to fix or mitigate EUVD-2025-19057?

Within 24 hours: Inventory all Allure 2 deployments and identify versions in use; restrict access to Allure report submission endpoints to trusted internal users/systems only. Within 7 days: Implement network segmentation to limit lateral movement from compromised Allure instances; monitor file system access logs for suspicious activity. Within 30 days: Upgrade to Allure 2.34.1 or later when available; conduct forensic review of submitted test files for indicators of exploitation.

Java EUVD-2025-19057

| CVE-2025-52888 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2025-06-24 security-advisories@github.com

GHSA-h7qf-qmf3-85qg

XXE SSRF Information Disclosure Java

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-19057

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

CVE Published

Jun 24, 2025 - 20:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (DocumentBuilderFactory) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.

AnalysisAI

Allure 2 versions prior to 2.34.1 contain a critical XML External Entity (XXE) injection vulnerability in the xunit-xml-plugin that allows unauthenticated remote attackers to read arbitrary files from the server's filesystem and potentially trigger SSRF attacks. The vulnerability stems from insecure XML parser configuration in the DocumentBuilderFactory and is exploitable by uploading or providing malicious test result XML files without any authentication or user interaction required.

Technical ContextAI

The vulnerability exists in the xunit-xml-plugin component used by Allure Report 2.x for parsing JUnit/XUnit test result XML files. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference), which occurs when the XML parser (DocumentBuilderFactory) is not configured to disable external entity expansion and DTD processing. Attackers can craft malicious XML files containing DOCTYPE declarations with external entity definitions pointing to local files (file:// protocol) or remote servers, causing the parser to resolve these entities and leak their contents. This affects the CPE scope: cpe:2.3:a:qameta:allure:2.0:*:*:*:*:*:*:* through cpe:2.3:a:qameta:allure:2.34.0:*:*:*:*:*:*:*, with remediation available in version 2.34.1 and later.

RemediationAI

Update dependency/installation: allure-report >= 2.34.1 Workaround (Temporary): Implement pre-processing validation: scan incoming XML for <!DOCTYPE and <!ENTITY patterns; reject or sanitize Defense in Depth: Network isolation, IAM hardening, file access auditing Vendor Advisory: Review: https://github.com/allure-framework/allure2 or vendor security advisory documentation