Skip to content

Commit 4e270e7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-64hm-gfwq-jppw GHSA-7rcv-55mj-chg7 GHSA-gc42-3jg7-rxr2
1 parent 56faf16 commit 4e270e7

3 files changed

Lines changed: 193 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-64hm-gfwq-jppw/GHSA-64hm-gfwq-jppw.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-64hm-gfwq-jppw",
4+
"modified": "2026-03-18T19:53:59Z",
5+
"published": "2026-03-18T19:53:59Z",
6+
"aliases": [
7+
"CVE-2026-33166"
8+
],
9+
"summary": "Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)",
10+
"details": "### Summary\nThe Allure report generator is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report.\n\n### Details\nThe vulnerability exists in several plugins where attachment paths are resolved using unvalidated user input. The code uses Path.resolve() without normalizing the path or checking if the resulting file remains within the intended results directory.\n\nAffected Files and Lines:\n\nAllure2Plugin.java (Line 264): `final Path attachmentFile = source.resolve(attachment.getSource());`\n\nAllure1Plugin.java (Line 328): `final Path attachmentFile = source.resolve(attachment.getSource());`\n\nXcTestPlugin.java (Line 181): `attachments.resolve(String.format(\"Screenshot_%s.%s\", uuid, ext))`\n\nSince `resolve()` allows absolute paths or ../ sequences to escape the base directory, any file readable by the process can be exfiltrated.\n\n### PoC\n1) Create a directory named allure-results.\n\n2) Create a file malicious-result.json inside it:\n\n```\n{\n \"uuid\": \"poc-traversal\",\n \"name\": \"Path Traversal PoC\",\n \"status\": \"passed\",\n \"attachments\": [\n {\n \"name\": \"Sensitive Data\",\n \"source\": \"../../../../../../../../../../../etc/passwd\",\n \"type\": \"text/plain\"\n }\n ]\n}\n```\n3) run `allure generate allure-results -o allure-report`\n\n4) The content of `/etc/passwd` will now be present in `allure-report/data/attachments/`.\n\n\n### Impact\nThis is a High Severity vulnerability. In CI/CD environments (GitHub Actions, Jenkins), an attacker submitting a Pull Request can exfiltrate server secrets, cloud credentials, or environment configuration files stored on the runner disk. It also may affect custom Allure web services where users can upload results, allowing them to read arbitrary files from the server's filesystem. Allure TestOps is not affected.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "io.qameta.allure:allure-generator"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.38.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.37.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/allure-framework/allure2/security/advisories/GHSA-64hm-gfwq-jppw"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/allure-framework/allure2"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-22"
54+
],
55+
"severity": "HIGH",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-03-18T19:53:59Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2026/03/GHSA-7rcv-55mj-chg7/GHSA-7rcv-55mj-chg7.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7rcv-55mj-chg7",
4+
"modified": "2026-03-18T19:54:30Z",
5+
"published": "2026-03-18T19:54:30Z",
6+
"aliases": [
7+
"CVE-2026-33172"
8+
],
9+
"summary": "Statamic has Stored XSS via SVG Sanitization Bypass",
10+
"details": "### Impact\n\nStored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed.\n\n### Patches\n\nThis has been fixed in 5.73.14 and 6.7.0.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "statamic/cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "6.0.0-alpha.1"
29+
},
30+
{
31+
"fixed": "6.7.0"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "statamic/cms"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "5.73.14"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/statamic/cms/security/advisories/GHSA-7rcv-55mj-chg7"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/statamic/cms"
65+
}
66+
],
67+
"database_specific": {
68+
"cwe_ids": [
69+
"CWE-79"
70+
],
71+
"severity": "HIGH",
72+
"github_reviewed": true,
73+
"github_reviewed_at": "2026-03-18T19:54:30Z",
74+
"nvd_published_at": null
75+
}
76+
}

‎advisories/github-reviewed/2026/03/GHSA-gc42-3jg7-rxr2/GHSA-gc42-3jg7-rxr2.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gc42-3jg7-rxr2",
4+
"modified": "2026-03-18T19:54:12Z",
5+
"published": "2026-03-18T19:54:12Z",
6+
"aliases": [
7+
"CVE-2026-33040"
8+
],
9+
"summary": "Gossipsub PRUNE.backoff Duration Overflow",
10+
"details": "### Summary\nThe Rust libp2p Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state.\nA specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication.\n\n### Attack Scenario\nAn attacker that can establish a libp2p Gossipsub session with a target node can crash the target by sending a single crafted PRUNE control message:\n1. Establish a standard libp2p transport session and negotiate a stream multiplexer.\n2. Open a Gossipsub stream and negotiate the meshsub protocol.\n3. Send one protobuf RPC containing ControlPrune with a very large backoff value (e.g. 18446744073709551615 / u64::MAX).\nWhen processed, the oversized backoff can reach time-update logic that adds Duration::from_secs(backoff) to Instant::now(), causing overflow and panic.\n\n### Impact\nRemote unauthenticated denial of service.\nAny application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message.\n### Patches\nUsers should upgrade to a release that hardens Gossipsub backoff handling.\n\nThis vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "crates.io",
21+
"name": "libp2p-gossipsub"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.49.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-gc42-3jg7-rxr2"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/libp2p/rust-libp2p"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-190"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-03-18T19:54:12Z",
55+
"nvd_published_at": null
56+
}
57+
}

0 commit comments

Comments
 (0)