CVE-2026-33166: io.qameta.allure:allure-generator Arbitrary File Read via Path Traversal
Summary
CVE-2026-33166: The Allure report generator is vulnerable to an arbitrary file read via path traversal when processing test results. Affects io.qameta.allure:allure-generator versions < 2.38.0. Fixed in 2.38.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Allure report generator is a popular tool used for generating test reports in various testing frameworks. It provides a comprehensive overview of test results, including detailed information about test cases, their statuses, and attachments such as screenshots and logs. However, it is vulnerable to an arbitrary file read due to improper handling of file paths during attachment processing.
Vulnerability Detail
The vulnerability arises from the way the Allure report generator resolves attachment paths using unvalidated user input. Specifically, the code utilizes Path.resolve() without normalizing the path or ensuring that the resulting file remains within the intended results directory. This oversight allows attackers to craft malicious result files that can point to sensitive files on the host system, leading to potential data exfiltration. The impact is particularly severe in CI/CD environments, where an attacker could exploit this vulnerability to access server secrets, cloud credentials, or environment configuration files stored on the runner disk.
How To Fix
Minimum fixed version
2.38.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using attachment sources that include absolute paths or .. sequences. Ensure that any result files processed by Allure do not contain references to sensitive files outside the intended directory.
Conclusion
CVE-2026-33166 represents a significant security risk for users of the Allure report generator, particularly in automated testing environments. It is crucial to update to the patched version to mitigate the risk of data exfiltration and ensure the security of sensitive information.
See every vulnerability recorded for io.qameta.allure:allure-generator →
FAQ
CVE-2026-33166 is a vulnerability in the Allure report generator that allows arbitrary file reads via path traversal during attachment processing.
An attacker could exploit this vulnerability to exfiltrate sensitive information such as server secrets or cloud credentials from the CI/CD runner.
Versions of io.qameta.allure:allure-generator up to 2.37.0 are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.qameta.allure:allure-generator.
