Vulnerability Description
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qameta | Allure Report | < 2.38.0 |
Related Weaknesses (CWE)
References
- https://github.com/allure-framework/allure2/security/advisories/GHSA-64hm-gfwq-jExploitVendor Advisory
FAQ
What is CVE-2026-33166?
CVE-2026-33166 is a vulnerability with a CVSS score of 8.6 (HIGH). Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversa...
How severe is CVE-2026-33166?
CVE-2026-33166 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33166?
Check the references section above for vendor advisories and patch information. Affected products include: Qameta Allure Report.