CVE-2025-52888 Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-52888?
CVE-2025-52888 is a high-severity vulnerability in allure-framework allure2, published on 24 Jun 2025.
Official description
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.
Weakness: CWE-611
Which versions are affected by CVE-2025-52888?
6 open source packages ship an affected version, including io.qameta.allure.plugins:junit-xml-plugin, io.qameta.allure.plugins:trx-plugin and io.qameta.allure.plugins:xunit-xml-plugin.
| Package | Affected | Fixed in |
|---|---|---|
io.qameta.allure.plugins:junit-xml-plugin Maven | All versions | 2.34.1 |
io.qameta.allure.plugins:junit-xml-plugin Maven | All versions | 2.34.1 |
io.qameta.allure.plugins:trx-plugin Maven | All versions | 2.34.1 |
io.qameta.allure.plugins:trx-plugin Maven | All versions | 2.34.1 |
io.qameta.allure.plugins:xunit-xml-plugin Maven | All versions | 2.34.1 |
io.qameta.allure.plugins:xunit-xml-plugin Maven | All versions | 2.34.1 |
How do I fix CVE-2025-52888?
Upgrade io.qameta.allure.plugins:junit-xml-plugin to 2.34.1 or later.
Is CVE-2025-52888 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-52888 exists.
Sources
Also known as GHSA-h7qf-qmf3-85qg.