CVE-2026-55846

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the percent-decoded request path to reportDirectory.resolve() without normalizing the result or confirming that it remains inside that directory. An unauthenticated client that can reach the server can submit parent-directory segments, including percent-encoded segments, and cause serveFile() to return any regular file readable by the Allure process. The server binds to localhost by default, but the --host option can expose it to other systems, and local users, adjacent containers, or browser-origin attacks may reach a local listener. This can disclose credentials, configuration, source code, build secrets, and other CI/CD data. This issue is fixed in version 2.39.0.

• CWE-22

• https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced
• https://github.com/allure-framework/allure2/pull/3288
• https://github.com/allure-framework/allure2/releases/tag/2.39.0
• https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc
• https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55838RustFS is a distributed object storage system built in Rust.…4.3
• CVE-2026-55839Kestra is an open-source, event-driven orchestration platfor…8.7
• CVE-2026-5584A vulnerability has been found in Fosowl agenticSeek 0.1.0. …9.8
• CVE-2026-55841Graylog is a free and open log management platform. Prior to…7.5
• CVE-2026-55843Snipe-IT is an IT asset/license management system. Prior to …6.5
• CVE-2026-55844Home Assistant is open source home automation software that …7.5
• CVE-2026-55847Allure 2 is the version 2.x branch of Allure Report, a multi…6.1
• CVE-2026-55848mapfish-print is a component of MapFish for printing templat…8.6
• CVE-2026-55849@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of …8.5
• CVE-2026-5585A vulnerability was found in Tencent AI-Infra-Guard 4.0. The…7.5
• CVE-2026-55850Element Web is a Matrix web client built using the Matrix Re…5.3
• CVE-2026-55851Netty is a network application framework for development of …7.5