Description

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:31.537Z",
  "pubdate": "2026-09-02T16:17:31.537Z",
  "executiveSummary": "The Jenkins Allure Plugin, versions 2.35.2 and earlier, contains a critical path traversal vulnerability that permits unauthorized file system access on the Jenkins controller.\nThis vulnerability is classified as an improper neutralization of input during path traversal, enabling attackers to bypass file system access restrictions.\nThe impact is significant, as a successful exploit allows an attacker to read arbitrary files from the Jenkins controller, potentially leading to the disclosure of sensitive credentials, configuration files, and system data.\nExploitation requires the attacker to possess Item/Read permission on a Jenkins job configured to publish Allure reports.\nThe vulnerability resides within the report rendering or file retrieval mechanism of the plugin, where user-controlled input used in file path construction is not sufficiently sanitized or validated.\nThis flaw presents a substantial risk to the confidentiality and integrity of the Jenkins controller environment, particularly in multi-user or shared CI/CD environments.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of directory traversal sequences (e.g., '../') within the Jenkins Allure Plugin's file retrieval process for published Allure reports.\nWhen a job is configured to publish Allure reports, the plugin must access and display artifacts stored on the Jenkins controller. The vulnerability occurs because the plugin fails to sanitize user-supplied file path parameters before utilizing them in file system API calls.\nAn attacker with Item/Read permissions on a Jenkins job can manipulate the request parameters associated with viewing Allure report artifacts. By injecting directory traversal characters, an attacker can break out of the intended directory context designated for Allure reports and traverse the underlying file system of the Jenkins controller.\nThe attack flow follows a structured exploitation pattern: First, the attacker identifies a Jenkins job that utilizes the Allure Plugin for report generation. Second, the attacker targets the web interface endpoint responsible for serving these reports. Third, the attacker crafts a malicious HTTP request by modifying the path parameter to include traversal sequences (e.g., /job/[job_name]/allure/file/?path=../../../etc/passwd).\nUpon receiving the request, the plugin processes the path without sufficient validation, effectively resolving the path relative to the Jenkins controller's root directory. The controller then executes a file read operation on the path resolved by the traversal, returning the content of the target file to the attacker through the web interface.\nBecause the plugin executes with the same privileges as the Jenkins controller process, the attacker is capable of reading any file accessible to the user running the Jenkins service. This includes sensitive files such as configuration files (config.xml), plugin data, secret stores (credentials.xml), and SSH keys stored in the Jenkins home directory.\nThe vulnerability is restricted by the need for initial Item/Read authorization, meaning the attacker must be a legitimate user of the Jenkins instance with access to at least one job configured for Allure reporting. However, given the nature of CI/CD environments where various teams often share permissions, this requirement is frequently met in internal environments."
}