Allure 2 versions before 2.39.0 have a path traversal vulnerability (CWE-22) in the HTTP server component used by allure serve and allure open commands. The server uses URI.getPath() and passes the percent-decoded request path to reportDirectory.resolve() without normalization or verifying that the resolved path remains within the intended directory. This allows an unauthenticated attacker who can reach the server to submit crafted paths with parent-directory segments (including percent-encoded ones) to read any regular file accessible by the Allure process. Although the server binds to localhost by default, the --host option can expose it externally, increasing attack surface. This can result in disclosure of sensitive CI/CD data such as credentials, configuration files, source code, and build secrets. The vulnerability is addressed in Allure 2.39.0.

An unauthenticated attacker able to reach the Allure 2 HTTP server can exploit this path traversal vulnerability to read arbitrary files on the host system that the Allure process has access to. This can lead to disclosure of sensitive information including credentials, configuration, source code, and build secrets. The default localhost binding limits exposure, but use of the --host option or local user/browser-origin attacks can increase risk.

Upgrade Allure 2 to version 2.39.0 or later, where this path traversal vulnerability is fixed. Until upgraded, avoid exposing the allure serve HTTP server beyond localhost and restrict access to trusted users only. No other vendor advisory or patch information is provided, so check the official Allure framework resources for the latest remediation guidance.