CVE-2026-26032
Apache Ivy: PackagerResolver path traversal vulnerability
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.
In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Ivy: PackagerResolver path traversal vulnerability
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.
In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
- Record
CVE-2026-26032- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-44763
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.
In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
- Record
EUVD-2026-44763- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j482-hm6j-v5jj
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them...
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.
In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
- Record
GHSA-j482-hm6j-v5jj- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.
In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
- Record
CVE-2026-26032- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Apache Ivy: PackagerResolver path traversal vulnerability
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.
In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
- Record
CVE-2026-26032- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-26032
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
- Record
UBUNTU-CVE-2026-26032- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2026:11326-1 No score
apache-ivy-2.6.0-1.1 on GA media
These are all security issues fixed in the apache-ivy-2.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11326-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21424-1 No score
Security update for apache-ivy
This update for apache-ivy fixes the following issue:
- CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting arbitrary files outside the configured "buildRoot" directory (bsc#1271727).
Changes for apache-ivy:
- Upgrade to 2.6.0:
- the ivy:retrieve task failed when the retrieve pattern contained some text in parentheses before the first token, for instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)
- when the ivy:deliver task is configured to replace dynamic revisions, it now replaces these revisions to the resolved revision before any conflict resolution was done, which was the original behavior before Ivy 2.3.0. This way, the delivered ivy.xml can be used to have reproducible dependency resolution, especially when multiple configurations are used. It also fixes issues where the dynamic revisions were replaced by versions from other configurations. (IVY-1485, IVY-1661)
- the ivy:deliver task didn't replace dynamic revision from inherited dependencies. (IVY-1410)
- the ivy:install task didn't take the from resolver into account when resolving Maven parent modules or source/javadoc artifacts.
- the ivy:checkdepsupdate task could suggest a lesser version as update. (IVY-1665)
- the ivy:makepom task no longer adds a dependency to the dependencyManagement section. (IVY-1667)
- the ivy:deliver task didn't include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658)
- the ivy:checkdepsupdate task no longer shows evicted versions. (IVY-1662)
- Improvements
- use Apache Commons Compress for pack200 handling to avoid issues on Java 14 and later. If pack200 is needed, make sure to add Apache Commons Compress to your classpath. (IVY-1652)
- ivy:retrieve and the 'post resolve tasks' now support the override child element. (IVY-1664)
- ivy:makepom will now add override elements of the ivy.xml to the dependencyManagement section of the generated pom. (IVY-1663)
- ivy:deliver and ivy:publish now writes inherited dependencies first to preserve resolve order (IVY-1656)
- ModuleRevisionId.encodeToString now returns a deterministic string that doesn't rely on a implmentation of HashMap
- New feature
- added a new nearest conflict manager, which handles conflicts in the same way that Maven does. (IVY-813)
- Record
openSUSE-SU-2026:21424-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22858-1 No score
Security update for apache-ivy
This update for apache-ivy fixes the following issue:
- CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting arbitrary files outside the configured "buildRoot" directory (bsc#1271727).
Changes for apache-ivy:
- Upgrade to 2.6.0:
- the ivy:retrieve task failed when the retrieve pattern contained some text in parentheses before the first token, for instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)
- when the ivy:deliver task is configured to replace dynamic revisions, it now replaces these revisions to the resolved revision before any conflict resolution was done, which was the original behavior before Ivy 2.3.0. This way, the delivered ivy.xml can be used to have reproducible dependency resolution, especially when multiple configurations are used. It also fixes issues where the dynamic revisions were replaced by versions from other configurations. (IVY-1485, IVY-1661)
- the ivy:deliver task didn't replace dynamic revision from inherited dependencies. (IVY-1410)
- the ivy:install task didn't take the from resolver into account when resolving Maven parent modules or source/javadoc artifacts.
- the ivy:checkdepsupdate task could suggest a lesser version as update. (IVY-1665)
- the ivy:makepom task no longer adds a dependency to the dependencyManagement section. (IVY-1667)
- the ivy:deliver task didn't include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658)
- the ivy:checkdepsupdate task no longer shows evicted versions. (IVY-1662)
- Improvements
- use Apache Commons Compress for pack200 handling to avoid issues on Java 14 and later. If pack200 is needed, make sure to add Apache Commons Compress to your classpath. (IVY-1652)
- ivy:retrieve and the 'post resolve tasks' now support the override child element. (IVY-1664)
- ivy:makepom will now add override elements of the ivy.xml to the dependencyManagement section of the generated pom. (IVY-1663)
- ivy:deliver and ivy:publish now writes inherited dependencies first to preserve resolve order (IVY-1656)
- ModuleRevisionId.encodeToString now returns a deterministic string that doesn't rely on a implmentation of HashMap
- New feature
- added a new nearest conflict manager, which handles conflicts in the same way that Maven does. (IVY-813)
- Record
SUSE-SU-2026:22858-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3225-1 No score
Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni
This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue
Security issues fixed:
- CVE-2026-26032: improper pathname limitation in
PackagerResolverallows for arbitrary files writes outside of the configuredbuildRootdirectory (bsc#1271727).
Other updates and bugfixes:
- Update
apache-commons-compressto 1.28.0. - Update
apache-ivyto 2.6.0. - Include
brotli-javaand update to 1.2.0. - Include
zstd-jniand update to v1.5.7.11.
- Record
SUSE-SU-2026:3225-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-ivySUSE:Linux Enterprise Server 16.0 |
before 2.6.0-160000.1.1 | 2.6.0-160000.1.1 |
apache-ivySUSE:Linux Enterprise Server for SAP applications 16.0 |
before 2.6.0-160000.1.1 | 2.6.0-160000.1.1 |
apache-commons-compressSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 1.28.0-150200.3.19.1 | 1.28.0-150200.3.19.1 |
apache-ivySUSE:Linux Enterprise Module for Development Tools 15 SP7 |
before 2.6.0-150200.3.12.1 | 2.6.0-150200.3.12.1 |
ivyUbuntu:14.04:LTS |
All versions, plus listed versions 2.3.0-22.3.0-3 |
None known |
ivyUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.0-42.4.0-3 |
None known |
ivyUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.0-3 |
None known |
ivyUbuntu:20.04:LTS |
All versions, plus listed versions 2.4.0-5 |
None known |
ivyUbuntu:22.04:LTS |
All versions, plus listed versions 2.5.0-12.5.0-2 |
None known |
ivyUbuntu:24.04:LTS |
All versions, plus listed versions 2.5.1-22.5.2-1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ivyUbuntu:26.10 |
All versions, plus listed versions 2.5.3-1 |
None known |
ivyUbuntu:26.04:LTS |
All versions, plus listed versions 2.5.3-1 |
None known |
apache-ivyopenSUSE:Tumbleweed |
before 2.6.0-1.1 | 2.6.0-1.1 |
apache-ivyopenSUSE:Leap 16.0 |
before 2.6.0-160000.1.1 | 2.6.0-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-26032 is a medium vulnerability (CVSS 5.4) in Apache Ivy, published July 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in apache-ivy 2.6.0-160000.1.1.