Jenkins Allure Plugin: path traversal lets Item/Read users read arbitrary controller files

Impact

A path traversal in the Allure report path lets any user with Item/Read on a job that publishes Allure results read arbitrary files from the Jenkins controller filesystem. The controller's filesystem is where credentials.xml, the master key and secret files, SSH keys for the fleet and any cached kubeconfig live, so arbitrary file read is effectively credential disclosure for whatever the controller can reach - clusters, registries, storage. Item/Read is the permission handed to everyone who wants to look at test results, which makes the population of potential attackers the whole engineering org rather than a privileged subset. Affects Allure Plugin 2.35.2 and earlier.

Who can reach it

Any authenticated user holding Item/Read on a job that publishes Allure report results. No user interaction required.

What to do

Update the Allure Plugin past 2.35.2 and restart the controller; the record does not name the fixed release. If you believe it was exploited, rotate anything reachable from the controller filesystem - the credentials store, agent keys, registry tokens - because a plugin upgrade does not invalidate what was already read. Short CI outage.

References

Related entries

• Jenkins Performance Plugin: unsafe deserialization of cached reports gives Item/Configure users RCECVE-2026-84670 · Jenkins Performance Plugin (cached performance report deserialization)High
• Jenkins File Parameter Plugin: arbitrary file write on the controller via data binding leads to RCECVE-2026-84671 · Jenkins File Parameter Plugin (Stapler data binding, file write path)High
• Jenkins Entra ID plugin: a colliding Entra group display name inherits a privileged group's permissionsCVE-2026-84672 · Jenkins Microsoft Entra ID plugin (group authorization by display name)High
• KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes APINCVD-2026-051-kubeedge-configupdatejob-handler · KubeEdge (ConfigUpdateJob handler, updateFields)High
• KubeEdge (NodeUpgradeJob handler, v1alpha2 API): REMOTE CODE EXECUTION ON EDGE NODES through the upgrade path. TheNCVD-2026-052-kubeedge-nodeupgradejob-handler · KubeEdge (NodeUpgradeJob handler, v1alpha2 API)High
• APC Network Management Card 4 (NMC4): An unauthenticated attacker can manipulate URL parameters to walk out of the webCVE-2024-58310 · APC Network Management Card 4 (NMC4)High