Vulnerability Description
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Ivy | >= 2.0.0, < 2.6.0 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyqMitigationVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/15/5Mailing ListThird Party Advisory
FAQ
What is CVE-2026-26032?
CVE-2026-26032 is a vulnerability with a CVSS score of 5.4 (MEDIUM). The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored i...
How severe is CVE-2026-26032?
CVE-2026-26032 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-26032?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Ivy.