A path traversal flaw in the Jenkins Allure Plugin allows an attacker to read files on the Jenkins controller. The vulnerability is triggered when an exploit attempts to navigate beyond the intended report directory, leveraging the path traversal to access any file on the file system that the Jenkins process can read. As a result, sensitive configuration, credentials, or code may be exfiltrated, compromising confidentiality and potentially enabling further attacks if the read files contain exploitable secrets.

The affected product is the Jenkins Allure Plugin developed by the Jenkins Project. Versions 2.35.2 and all earlier iterations are vulnerable. Upstream patches have published newer releases beyond 2.35.2 that remediate the traversal issue.

The flaw carries a CVSS score of 8.8, indicating high severity. No EPSS score is available, but the absence of a KEV listing suggests it has not yet been widely exploited. The likely attack vector requires an authenticated user with Item/Read permission on a job that publishes Allure reports; this permission is required to trigger the vulnerable plugin path resolution. Once authenticated, the attacker can read arbitrary files, creating a significant confidentiality risk, especially for untrusted or compromised accounts.