https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 16:39:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-245785 EUVD-2026-245785 https://cve.radiocsirt.org/vuln/euvd-2026-245785 https://cve.radiocsirt.org/vuln/fkie_cve-2025-52888 <p>Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.</p> <p>Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-52888 https://cve.radiocsirt.org/vuln/ghsa-h7qf-qmf3-85qg <p><strong>Affected:</strong> Maven: io.qameta.allure.plugins:xunit-xml-plugin, Maven: io.qameta.allure.plugins:junit-xml-plugin, Maven: io.qameta.allure.plugins:trx-plugin</p> <p>### Summary A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF).</p> <p>### Details In `\allure2-main\plugins\xunit-xml-plugin\src\main\java\io\qameta\allure\xunitxml\XunitXmlPlugin.java` the application uses `DocumentBuilderFactory` without disabling DTDs or external entities. By generating a report with a malicious xml file within it, an attacker can perform XXE to leverage SSRF, or to read system files.</p> <p>### PoC To recreate this vulnerability, you need to install allure for command-line (In my POC I used a Windows 11 Machine).</p> <p>1. Create a folder called `allure`, and within it, create a malicious XML file. I will attach my SSRF and file reading payloads, however, for the rest of the POC, I will focus on reading system files for better screenshots. ##SSRF (replace webhook link with your own) </p> <p>##Reading System Files </p> <p>2. Put the malicious .xml file into the `allure` directory created previously 3. Run the following command to run the report `allure generate C:\path\to\directory…</p> <p><strong>Affected:</strong> Maven: io.qameta.allure.plugins:xunit-xml-plugin, Maven: io.qameta.allure.plugins:junit-xml-plugin, Maven: io.qameta.allure.plugins:trx-plugin</p> <p>### Summary A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF).</p> <p>### Details In `\allure2-main\plugins\xunit-xml-plugin\src\main\java\io\qameta\allure\xunitxml\XunitXmlPlugin.java` the application uses `DocumentBuilderFactory` without disabling DTDs or external entities. By generating a report with a malicious xml file within it, an attacker can perform XXE to leverage SSRF, or to read system files.</p> <p>### PoC To recreate this vulnerability, you need to install allure for command-line (In my POC I used a Windows 11 Machine).</p> <p>1. Create a folder called `allure`, and within it, create a malicious XML file. I will attach my SSRF and file reading payloads, however, for the rest of the POC, I will focus on reading system files for better screenshots. ##SSRF (replace webhook link with your own) </p> <p>##Reading System Files </p> <p>2. Put the malicious .xml file into the `allure` directory created previously 3. Run the following command to run the report `allure generate C:\path\to\directory…</p> https://cve.radiocsirt.org/vuln/ghsa-h7qf-qmf3-85qg