CVE-2026-84669 in Allure Plugin
Summary
by MITRE • 09/02/2026
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The discovery of a path traversal vulnerability within Jenkins Allure Plugin versions 2.35.2 and earlier highlights critical security risks associated with how plugins handle user-supplied input when serving static content or reports. This flaw specifically impacts environments where attackers possess Item/Read permissions on jobs configured to publish Allure report results. The core technical issue stems from insufficient validation of file path inputs, allowing malicious actors to manipulate directory traversal sequences such as dot-dot-slash sequences to escape the intended sandboxed directory structure. By exploiting this weakness, an authenticated user can construct requests that reference files located outside the designated reporting directories, effectively bypassing access controls designed to isolate job-specific data.
From a technical perspective, the vulnerability arises because the plugin fails to properly canonicalize or sanitize file paths before processing them for retrieval. When Jenkins serves Allure reports, it typically restricts access to specific subdirectories associated with each build or project. However, due to the lack of rigorous boundary checks on path parameters, an attacker can inject characters that traverse up the directory hierarchy using standard relative path notation. This allows the request handler to resolve paths pointing to arbitrary locations on the Jenkins controller's file system rather than staying within the expected report folder. The flaw is particularly dangerous because it leverages existing authentication and authorization mechanisms; since the attacker already has Item/Read permission, they are authenticated into the system, making this an abuse of privilege scenario rather than a complete bypass of login requirements.
The operational impact of this vulnerability is severe for organizations relying on Jenkins for continuous integration and deployment pipelines. Successful exploitation enables attackers to read sensitive files stored on the controller node, which may include configuration files containing database credentials, SSH keys, API tokens, or other secrets used in pipeline scripts. This unauthorized access can lead to further compromise of the CI/CD infrastructure, potentially allowing lateral movement into internal networks or extraction of intellectual property. The ability to read arbitrary files undermines the integrity and confidentiality guarantees provided by Jenkins' role-based access control model, as it effectively grants elevated file system privileges beyond what is intended for users with only job-level read permissions.
This vulnerability aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal attacks. It also relates to ATT&CK technique T1083, File and Directory Discovery, where adversaries explore the target system's file structure to gather information for further exploitation. In the context of MITRE ATT&CK, this action falls under Initial Access if it leads to credential theft, but more accurately represents a post-exploitation activity focused on reconnaissance and data staging within the CI/CD environment. The vulnerability underscores the importance of strict input validation and secure coding practices in plugins that interact with the underlying operating system's file system.
To mitigate this risk, organizations should immediately upgrade the Jenkins Allure Plugin to version 2.35.3 or later, where the path traversal issue has been addressed through improved input sanitization and path canonicalization checks. Administrators must also enforce the principle of least privilege by ensuring that users only have Item/Read permissions on jobs they are authorized to view, avoiding broad administrative access for standard developers. Additionally, running Jenkins controllers with restricted file system permissions can limit the impact if a vulnerability is exploited in the future. Regular auditing of plugin versions and monitoring for unusual file access patterns within CI/CD pipelines will further enhance security posture against such traversal-based attacks.