The Jenkins Allure Plugin is vulnerable to a path traversal flaw that permits attackers with low-level privileges to access sensitive files on the host system.

This is a path traversal vulnerability triggered when processing Allure report results. The flaw allows an attacker with Item/Read permissions on a Jenkins job to bypass directory restrictions and access arbitrary files on the Jenkins controller.

The ability to read arbitrary files on the Jenkins controller poses a significant risk to organizational security. An attacker could extract credentials, configuration files, or sensitive build artifacts, leading to full system compromise or lateral movement within the development environment. Given the high CVSS score of 8.8, this vulnerability represents a severe threat to the integrity and confidentiality of the CI/CD pipeline.

Immediate Action: Review the official Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3645 and apply the latest security update as soon as it is released by the vendor.

Proactive Monitoring: Monitor Jenkins access logs for unusual patterns involving file path requests or unauthorized attempts to access sensitive system directories via the Allure plugin endpoint.

Compensating Controls: Restrict Item/Read permissions to trusted users only and implement network segmentation to isolate the Jenkins controller from critical internal infrastructure.

Public Exploit Available: No

This high-severity vulnerability requires immediate attention from security teams managing Jenkins infrastructure. Administrators should audit the use of the Allure plugin and restrict access to relevant jobs while awaiting a verified patch from the Jenkins project. Prioritize the application of security updates once available to prevent potential unauthorized access to the controller environment.