Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-52888: Allure Report: XML Files Can Reveal Sensitive Data

CVE-2025-52888 · published 1 year ago

Summary

A security issue in Allure Report's test result XML files allows attackers to access sensitive information on your server. This could help an attacker steal files or fake requests to other systems. To stay safe, update to version 2.34.1 of Allure Report.

What to do

Update qameta io.qameta.allure.plugins:xunit-xml-plugin to version 2.34.1.
Update qameta io.qameta.allure.plugins:junit-xml-plugin to version 2.34.1.
Update qameta io.qameta.allure.plugins:trx-plugin to version 2.34.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	qameta	io.qameta.allure.plugins:xunit-xml-plugin	<= 2.34.0 Fix: upgrade to 2.34.1
maven	qameta	io.qameta.allure.plugins:junit-xml-plugin	<= 2.34.0 Fix: upgrade to 2.34.1
maven	qameta	io.qameta.allure.plugins:trx-plugin	<= 2.34.0 Fix: upgrade to 2.34.1

Original advisory text

Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.

References

https://github.com/advisories/GHSA-h7qf-qmf3-85qg
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52888... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-52888 Vendor Advisory
https://github.com/allure-framework/allure2/security/advisories/GHSA-h7qf-qmf3-8... Vendor Advisory
https://github.com/allure-framework/allure2/commit/cbcb33719851ff70adce85d38e15d... Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-611XML External Entity (XXE)

Timeline

Published24 Jun 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-h7qf-qmf3-85qg · GHSA

CVE-2025-52888 · NVD

CVE-2025-52888 · OSV

Track software like this

Free during beta