CVE-2026-84669

CVE-2026-84669 is a path traversal vulnerability (CWE-22) in the Allure Plugin for Jenkins, affecting versions 2.35.2 and earlier, and is rated 8.8 (High) on the CVSS 3.1 scale. An attacker who holds Item/Read permission on a Jenkins job that publishes Allure report results can leverage the traversal in the plugin's report handling to make the Jenkins controller read files from arbitrary locations on its file system. Successful exploitation yields arbitrary file reads on the controller, potentially exposing configuration, secrets, and credentials stored on the controller host. Any Jenkins controller running the Allure Plugin at version 2.35.2 or earlier is affected, and exploitation requires an authenticated attacker with Item/Read access rather than anonymous access. There is no known public proof-of-concept or in-the-wild exploitation, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days.

What to do: Update the Allure Plugin to the latest release (any version newer than 2.35.2) on every controller, and audit which controllers currently run the vulnerable version. Until patched, restrict Item/Read permissions on jobs that publish Allure report results to limit who can trigger the traversal. Review sensitive controller-host material (e.g., configuration and secret files in JENKINS_HOME) that an arbitrary file read could expose.