Directory Traversal Vulnerability in Allure Report by Qameta

CVE-2026-55846

What is CVE-2026-55846?

Allure Report versions before 2.39.0 contain a directory traversal vulnerability due to improper handling of the URI request path in the HTTP server. This flaw allows an unauthenticated attacker with access to the server to exploit directory traversal techniques, potentially disclosing sensitive files such as credentials, configuration settings, and source code. The issue arises from the lack of normalization when resolving paths, particularly when the server is configured to listen on all interfaces, exposing it to risks from local users, adjacent containers, or web-based attacks. Users are strongly urged to upgrade to version 2.39.0 or later to mitigate this risk.

References