CVE-2026-33166
High
Description
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.
SeverityHigh
CVSS8.6
Exploit probability—
ProductQameta Allure Report
PublishedMar 20, 2026
First seenMar 20, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- qameta allure_report2.38.0 or later
- io.qameta.allure:allure-generator2.38.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qameta allure_report | v < 2.38.0 | 2.38.0 |
| io.qameta.allure:allure-generatorMaven | v < 2.38.0 | 2.38.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.