CVE-2026-33166: 
Java vulnerability analysis and mitigation

CVE-2026-33166 is an arbitrary file read vulnerability via path traversal in the Allure Report generator, affecting the Allure 1, Allure 2, and XCTest reader plugins. It was published on March 17, 2026, and affects all versions of io.qameta.allure:allure-generator up to and including 2.37.0, with version 2.38.0 containing the fix. The vulnerability carries a CVSS v3.1 base score of 8.6 (High) per the GitHub Advisory, with a scope-changed rating reflecting cross-boundary file access (GitHub Advisory, Allure2 Advisory).

The root cause is CWE-22 (Path Traversal): attachment paths in test result files are resolved using Java's Path.resolve() without normalizing the path or validating that the resolved location remains within the intended results directory. This affects three specific code locations — Allure2Plugin.java (line 264), Allure1Plugin.java (line 328), and XcTestPlugin.java (line 181) — where user-controlled input from -result.json, -container.json, or .plist files is passed directly to resolve(). Because resolve() honors both absolute paths and ../ sequences, an attacker can craft a malicious result file with an attachment source field pointing to any file readable by the process (e.g., ../../../../../../../../../../../etc/passwd), causing Allure to copy that file into the generated report's data/attachments/ directory (GitHub Advisory, Allure2 Advisory).

Successful exploitation results in arbitrary file read from the host filesystem, limited to files accessible by the process running Allure. In CI/CD environments such as GitHub Actions or Jenkins, an attacker who can submit a Pull Request can exfiltrate server secrets, cloud credentials (e.g., AWS keys, service account tokens), and environment configuration files stored on the runner disk. Custom Allure web services that allow users to upload test results are also at risk, enabling unauthenticated users to read arbitrary server-side files. Allure TestOps is explicitly noted as not affected (GitHub Advisory).

1. Identify a target: Locate a CI/CD pipeline (e.g., GitHub Actions, Jenkins) that uses Allure Report ≤ 2.37.0 to generate test reports from pull request submissions, or a custom Allure web service that accepts user-uploaded result files.
2. Craft a malicious result file: Create a file named malicious-result.json with a path traversal payload in the source field of an attachment:

{
  "uuid": "poc-traversal",
  "name": "Path Traversal PoC",
  "status": "passed",
  "attachments": [
    {
      "name": "Sensitive Data",
      "source": "../../../../../../../../../../../etc/passwd",
      "type": "text/plain"
    }
  ]
}

3. Deliver the payload: Place the malicious JSON file in the allure-results directory and submit it via a Pull Request to a repository whose CI pipeline runs allure generate, or upload it directly to a vulnerable Allure web service.
4. Trigger report generation: The CI pipeline or web service runs allure generate allure-results -o allure-report, causing Allure to resolve the traversal path and copy the target file into allure-report/data/attachments/.
5. Retrieve the exfiltrated file: Access the generated report (e.g., via the CI artifact store or web service UI) and download the attachment, which now contains the contents of the targeted sensitive file (Allure2 Advisory).

• File System: Unexpected files appearing in allure-report/data/attachments/ that match sensitive system files (e.g., passwd, .env, credential files, SSH keys); result JSON files in allure-results/ containing ../ sequences or absolute paths in the source field of attachments.
• Logs: CI/CD pipeline logs showing allure generate processing result files with unusual attachment source paths; file access events (if auditing is enabled) showing the Allure process reading files outside the results directory (e.g., /etc/passwd, ~/.aws/credentials).
• Network: In web service deployments, HTTP requests uploading result files containing path traversal sequences in attachment source fields; subsequent downloads of generated report attachments containing unexpected content.

Upgrade io.qameta.allure:allure-generator to version 2.38.0 or later, which resolves the path traversal by properly validating and normalizing attachment paths before resolution (Allure2 Advisory). As interim mitigations: restrict who can submit Pull Requests or upload test results to trusted contributors only; run Allure report generation in an isolated environment (e.g., a container with minimal filesystem access and no sensitive credentials mounted); and audit existing generated reports for unexpected files in data/attachments/. For custom Allure web services, implement authentication and authorization on result upload endpoints.

The vulnerability received coverage from The Hacker Wire and was noted on Mastodon and Bluesky shortly after disclosure (The Hacker Wire). Security aggregators including radar.offseq.com and infinitsec.net published summaries highlighting the CI/CD supply chain risk angle. Community reaction focused on the ease of exploitation given the public PoC and the broad exposure of CI/CD pipelines that automatically process pull request test results.