CVE-2025-52888
Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.
Reserved 2025-06-20 | Published 2025-06-24 | Updated 2025-06-24 | Assigner GitHub_MCWE-611: Improper Restriction of XML External Entity Reference
github.com/...llure2/security/advisories/GHSA-h7qf-qmf3-85qg
github.com/...ommit/cbcb33719851ff70adce85d38e15d20fc58d4eb7
Support options
