{"id":"CVE-2026-55846","summary":"Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read","details":"Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the percent-decoded request path to reportDirectory.resolve() without normalizing the result or confirming that it remains inside that directory. An unauthenticated client that can reach the server can submit parent-directory segments, including percent-encoded segments, and cause serveFile() to return any regular file readable by the Allure process. The server binds to localhost by default, but the --host option can expose it to other systems, and local users, adjacent containers, or browser-origin attacks may reach a local listener. This can disclose credentials, configuration, source code, build secrets, and other CI/CD data. This issue is fixed in version 2.39.0.","aliases":["GHSA-82cg-3hv7-74gc"],"modified":"2026-09-17T08:04:59.179280Z","published":"2026-09-14T17:20:49.131Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55846.json"},"references":[{"type":"WEB","url":"https://github.com/allure-framework/allure2/releases/tag/2.39.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55846.json"},{"type":"ADVISORY","url":"https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55846"},{"type":"FIX","url":"https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced"},{"type":"FIX","url":"https://github.com/allure-framework/allure2/pull/3288"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/allure-framework/allure2","events":[{"introduced":"0"},{"fixed":"e83cd67658bc2266832ab366eadd0bc1f48baced"},{"fixed":"224d3dd5d6f6df30e8f9cbace62696d2c24d688f"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"2.39.0"}]}}],"versions":["2.38.1","2.38.0","2.37.0","2.36.0","2.35.1","2.35.0","2.34.1","2.34.0","2.33.0","2.32.2","2.32.1","2.32.0","2.31.0","2.30.0","2.29.0","2.28.0","2.27.0","2.26.0","2.25.0","2.24.1","2.24.0","2.23.1","2.23.0","2.22.4","2.22.3","2.22.2","2.22.1","2.22.0","2.21.0","2.20.1","2.20.0","2.19.0","2.18.1","2.18.0","2.17.3","2.17.2","2.17.1","2.17.0","2.16.1","2.16.0","2.15.0","2.14.0","2.13.10","2.13.9","2.13.8","2.13.7","2.13.6","2.13.5","2.13.4","2.13.3","2.13.2","2.13.1","2.13.0","2.12.1","2.12.0","2.11.0","2.10.0","2.9.0","2.8.1","2.8.0","2.7.0","2.6.0","2.5.0","2.4.1","2.4.0","2.3.5","2.3.4","2.3.3","2.3.2","2.3.1","2.3","2.2.1","2.2.0","2.1.1","2.1.0","2.0.1","2.0.0","2.0-BETA8","2.0-BETA7","2.0-BETA6","2.0-BETA5","2.0-BETA4","2.0-BETA3","2.0-BETA1","2.0-M1"],"database_specific":{"vanir_signatures_modified":"2026-09-17T08:04:59Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced","target":{"file":"allure-commandline/src/test/java/io/qameta/allure/CommandsTest.java"},"deprecated":false,"digest":{"line_hashes":["195898546388040838540614310327095387053","39947032067124411669288103689146105524","152247363250014526775783704877010534155","269433217175946267179524597349981069808","314484585546143068878514863516229291931","290118331838170950600587858361877585046","44233781341740472992052807052115089080","302371445227304678471884643731326527032","312754808438484298071334303629699416744","223405986375853176935577015370616934362","255572181908016630834753812527974514917","88013426860240655984142772844648821544","289447202564192656898963564480840830643"],"threshold":0.9},"id":"CVE-2026-55846-38e61ede","signature_type":"Line"},{"deprecated":false,"digest":{"length":515,"function_hash":"295366171593418579507555917171560969509"},"id":"CVE-2026-55846-3a806d98","signature_type":"Function","signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced","target":{"function":"setUpServer","file":"allure-commandline/src/main/java/io/qameta/allure/Commands.java"}},{"signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced","target":{"file":"allure-commandline/src/main/java/io/qameta/allure/Commands.java","function":"serveFile"},"deprecated":false,"digest":{"function_hash":"50381159618762559219254451116749260000","length":564},"id":"CVE-2026-55846-9c3f2078","signature_type":"Function"},{"digest":{"line_hashes":["34305336951096552734359947020636528806","73102104640656501549886758145786140095","44824430287999437057015555887667515639","151120573845099280534465321645565623412","201043851334710550786836240670199166800","150400490747676397829471993940158560852","179227681237092516613927473781687056516","150889037886018292710062590941779206891","325081353761923485028826479225142035320","141092617253512969822974447100429658842","150745895519541210973690382197154682671","266530347863460327346750594716016866387","84649774155916184135714954325692653943","315102802154725393144279198727991726021","306834887367050699966491540727217496044","236044434249763340073520396617626794212","73683216921891694247226660612871965387","249395196419804326749223329108415282571","88108734104225871252682619194243319325","44385526741056233412878067560765000834","6094215940636711587534300113321161108","72426385728109273923510823424629260985","73350214691148696531027700827473358289","312028743268840105581848740215121515411","108218086411153416761387652449608750213","110672533701444487012266465481796977576","169007638753615655481880067528918156303","168603539893415250136335490296359859727","303195718055520522836957924863513729690","91624804874387419525018367001352306171","129043377545051362293816524313226844242","288041932027354833640674227943955300855","203140701991881319554654091230859055457","70954427024763185716265943462495932390","293789464498161092894771784711039843111","174322728937021680633691642780634873036","330506255647433754938381444855151612627","212391181561509282599551020969322461560","155673364268633683859811043832769818581","213160056601179688233772516795786324007","41047673494938919829217574319960632840","247427507448679605653124214655712271901","289076126348102199991672445860077428755","105752241052514355554015528503925262808"],"threshold":0.9},"id":"CVE-2026-55846-cf787f0b","signature_type":"Line","signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced","target":{"file":"allure-commandline/src/main/java/io/qameta/allure/Commands.java"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55846.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}