CVE-2026-55846

Allure 2 (allure-commandline) prior to 2.39.0 contains a path traversal vulnerability in the HTTP server started by allure serve and allure open. The handler in Commands.setUpServer() resolves the percent-decoded request path against the report directory without normalizing or validating containm...