allure2 vulnerabilities

2 known vulnerabilities in allure2 from Allure-framework. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  allure2: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-33166Mar 20, 2026Allure-framework

  Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a mali

• 7.5 High severity

  allure2: Improper Restriction of XML External Entity Reference

  CVE-2025-52888Jun 24, 2025Allure-framework

  Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XM