Allure-framework vulnerabilities
We track 2 vulnerabilities in Allure-framework products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 20, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Allure-framework vulnerabilities
- 7.5 High severity
allure2: Improper Limitation of a Pathname to a Restricted Directory
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a mali
- 7.5 High severity
allure2: Improper Restriction of XML External Entity Reference
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XM