CVE-2026-55846

Name of the Vulnerable Software and Affected Versions Allure 2 versions prior to 2.39.0

Description The built-in HTTP server started by allure serve and allure open is susceptible to path traversal. The server uses URI.getPath() within the setUpServer() function to resolve request paths against the report directory but fails to normalize the result or verify that the final path remains within the intended directory. An unauthenticated client can use parent-directory segments (e.g., ../), including percent-encoded versions (e.g., %2e%2e), to trick the serveFile() function into returning any regular file readable by the Allure process. While the server binds to localhost by default, using the --host option can expose it to external systems. This flaw can lead to the disclosure of sensitive information such as credentials, configuration files, source code, and build secrets, particularly in CI/CD and containerized environments.

Recommendations Update Allure 2 to version 2.39.0 or later. As a temporary mitigation, avoid using the --host option to expose the server to external networks and restrict access to the local listener.