VulnSocial

CVE-2026-33166Patch(qameta / allure_report)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch qameta allure_report systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.

qameta CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • allure_report

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-03-20); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
qameta
Products
allure_report

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-20: 2Mentions · 2026-03-21: 1Patch / Workaround · 2026-03-20: 1Patch / Workaround · 2026-03-21: 1Technical Details · 2026-03-20: 203-2003-21
Signal classification2 categories
Patch
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-202
General1Patch1
2026-03-211
Patch1
Full discourse3 posts
  • CVE@CVEnew
    Patch

    CVE-2026-33166 Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arb… https://www.cve.org/CVERecord?id=CVE-2026-33166

    Post summary

    The text announces that Allure Report versions before 2.38.0 contain CVE‑2026‑33166 and recommends upgrading to a fixed version to mitigate the issue.

    00000152
    56.8K followersView on X
  • The Hacker Wire@TheHackerWire
    General

    🟠 CVE-2026-33166 - High Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path... https://www.thehackerwire.com/vulnerability/CVE-2026-33166/ https://t.co/dW7tF2DmHm

    Post summary

    A new CVE-2026-33166 vulnerability in Allure Report allows arbitrary file reading in versions prior to 2.38.0, with a reference to an external article but no disclosed patches or active exploitation details.

    0000038
    138 followersView on X
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-33166: HIGH] Allure Report generator prior to version 2.38.0 is vulnerable to arbitrary file reads via path traversal in test results, fixed in version 2.38.0. #cybersecurity.#cve,CVE-2026-33166,#cybersecurity https://cvefind.com/CVE-2026-33166

    Post summary

    Allure Report generator is vulnerable to arbitrary file reads via path traversal. It has been fixed in version 2.38.0.

    0000041
    604 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appqametaallure_report---

Explore more

Back to dashboardqameta CVEsallure_report vulnerabilities