CVE-2026-55846

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55846
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55846.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55846
Aliases
Downstream
Published
2026-09-14T17:20:49Z
Modified
2026-09-17T08:04:59Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read
Details

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the percent-decoded request path to reportDirectory.resolve() without normalizing the result or confirming that it remains inside that directory. An unauthenticated client that can reach the server can submit parent-directory segments, including percent-encoded segments, and cause serveFile() to return any regular file readable by the Allure process. The server binds to localhost by default, but the --host option can expose it to other systems, and local users, adjacent containers, or browser-origin attacks may reach a local listener. This can disclose credentials, configuration, source code, build secrets, and other CI/CD data. This issue is fixed in version 2.39.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55846.json"
}
References

Affected packages

Git / github.com/allure-framework/allure2

Affected ranges

Type
GIT
Repo
https://github.com/allure-framework/allure2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e83cd67658bc2266832ab366eadd0bc1f48baced
Fixed
224d3dd5d6f6df30e8f9cbace62696d2c24d688f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.39.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.0-BETA1
2.0-BETA3
2.0-BETA4
2.0-BETA5
2.0-BETA6
2.0-BETA7
2.0-BETA8
2.0-M1
2.0.0
2.0.1
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.12.1
2.13.0
2.13.1
2.13.10
2.13.2
2.13.3
2.13.4
2.13.5
2.13.6
2.13.7
2.13.8
2.13.9
2.14.0
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.17.2
2.17.3
2.18.0
2.18.1
2.19.0
2.2.0
2.2.1
2.20.0
2.20.1
2.21.0
2.22.0
2.22.1
2.22.2
2.22.3
2.22.4
2.23.0
2.23.1
2.24.0
2.24.1
2.25.0
2.26.0
2.27.0
2.28.0
2.29.0
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.30.0
2.31.0
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.34.1
2.35.0
2.35.1
2.36.0
2.37.0
2.38.0
2.38.1
2.4.0
2.4.1
2.5.0
2.6.0
2.7.0
2.8.0
2.8.1
2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55846.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195898546388040838540614310327095387053",
                "39947032067124411669288103689146105524",
                "152247363250014526775783704877010534155",
                "269433217175946267179524597349981069808",
                "314484585546143068878514863516229291931",
                "290118331838170950600587858361877585046",
                "44233781341740472992052807052115089080",
                "302371445227304678471884643731326527032",
                "312754808438484298071334303629699416744",
                "223405986375853176935577015370616934362",
                "255572181908016630834753812527974514917",
                "88013426860240655984142772844648821544",
                "289447202564192656898963564480840830643"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55846-38e61ede",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced",
        "target": {
            "file": "allure-commandline/src/test/java/io/qameta/allure/CommandsTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "295366171593418579507555917171560969509",
            "length": 515
        },
        "id": "CVE-2026-55846-3a806d98",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced",
        "target": {
            "file": "allure-commandline/src/main/java/io/qameta/allure/Commands.java",
            "function": "setUpServer"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "50381159618762559219254451116749260000",
            "length": 564
        },
        "id": "CVE-2026-55846-9c3f2078",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced",
        "target": {
            "file": "allure-commandline/src/main/java/io/qameta/allure/Commands.java",
            "function": "serveFile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "34305336951096552734359947020636528806",
                "73102104640656501549886758145786140095",
                "44824430287999437057015555887667515639",
                "151120573845099280534465321645565623412",
                "201043851334710550786836240670199166800",
                "150400490747676397829471993940158560852",
                "179227681237092516613927473781687056516",
                "150889037886018292710062590941779206891",
                "325081353761923485028826479225142035320",
                "141092617253512969822974447100429658842",
                "150745895519541210973690382197154682671",
                "266530347863460327346750594716016866387",
                "84649774155916184135714954325692653943",
                "315102802154725393144279198727991726021",
                "306834887367050699966491540727217496044",
                "236044434249763340073520396617626794212",
                "73683216921891694247226660612871965387",
                "249395196419804326749223329108415282571",
                "88108734104225871252682619194243319325",
                "44385526741056233412878067560765000834",
                "6094215940636711587534300113321161108",
                "72426385728109273923510823424629260985",
                "73350214691148696531027700827473358289",
                "312028743268840105581848740215121515411",
                "108218086411153416761387652449608750213",
                "110672533701444487012266465481796977576",
                "169007638753615655481880067528918156303",
                "168603539893415250136335490296359859727",
                "303195718055520522836957924863513729690",
                "91624804874387419525018367001352306171",
                "129043377545051362293816524313226844242",
                "288041932027354833640674227943955300855",
                "203140701991881319554654091230859055457",
                "70954427024763185716265943462495932390",
                "293789464498161092894771784711039843111",
                "174322728937021680633691642780634873036",
                "330506255647433754938381444855151612627",
                "212391181561509282599551020969322461560",
                "155673364268633683859811043832769818581",
                "213160056601179688233772516795786324007",
                "41047673494938919829217574319960632840",
                "247427507448679605653124214655712271901",
                "289076126348102199991672445860077428755",
                "105752241052514355554015528503925262808"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55846-cf787f0b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/allure-framework/allure2/commit/e83cd67658bc2266832ab366eadd0bc1f48baced",
        "target": {
            "file": "allure-commandline/src/main/java/io/qameta/allure/Commands.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-17T08:04:59Z"