Threats affecting pkg:maven/io.qameta.allure/allure2

CVE-2026-55846 is a path traversal vulnerability in Allure 2, a multi-language test reporting tool. Versions prior to 2.39.0 have an HTTP server that improperly handles pathname resolution, allowing an unauthenticated client to access arbitrary files readable by the Allure process. The server binds to localhost by default but can be exposed to other systems via the --host option. This vulnerability can lead to disclosure of sensitive information such as credentials, configuration files, source code, and CI/CD secrets. The issue is fixed in version 2.39.0.