A path traversal vulnerability in Allure Report versions prior to 2.38.0 allows unauthenticated attackers to read arbitrary files from the underlying host system, posing a significant risk to data confidentiality.

This is a path traversal vulnerability (CWE-22) in the Allure report generation process. An unauthenticated attacker can supply a malicious test result file that forces the generator to read and include arbitrary sensitive files from the host filesystem in the final report output.

The ability to perform arbitrary file reads can lead to the unauthorized disclosure of sensitive system information, configuration files, or credentials stored on the server. With a CVSS score of 8.6, this vulnerability represents a high-severity risk that could be leveraged to gain deep insight into the internal environment, facilitating further exploitation or lateral movement.

Immediate Action: Update the Allure generator to version 2.38.0 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Monitor build pipelines and report generation logs for unexpected file access patterns or unusually large report artifacts that might indicate data exfiltration attempts.

Compensating Controls: Ensure that the Allure report generation process runs with the least privilege necessary, ideally within a restricted container or sandbox environment to limit access to the broader host filesystem.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for unauthenticated access to system files, this vulnerability should be prioritized for remediation. Organizations should audit their test automation pipelines for exposure and apply the update to version 2.38.0 without delay to prevent potential data compromise.