14 matches found
CVE-2026-54550
creationtimestamp| type| source ---|---|--- 2026-08-26 16:35:15+00:00| published-proof-of-concept| https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9...
CVE-2026-54550
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...
GHSA-F63G-88CJ-HJF9 IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
Summary IzPack's UnpackerBase.unpack resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR the format is unsigned can include pack entries whose targetPath contains ../ sequences. When a victim runs the...
com.github.robozonky.distribution:robozonky-distribution-aggregate (>=5.6.0-cr-1, <=6.4.1), com.github.robozonky.distribution:robozonky-distribution-installer (>=6.0.0-beta-1, <=6.4.1) +20 more potentially affected by CVE-2026-54550 via org.codehaus.izpack:izpack-installer (>=5.0.0-beta1, <=5.2.6)
org.codehaus.izpack:izpack-installer MAVEN version =5.0.0-beta1, =5.6.0-cr-1, =6.0.0-beta-1, =4.0.0-cr-1, =4.0.0-cr-1, =4.6.0-cr-1, =3.1.0, =3.1.0, =2.0.43, =1.3, =5.0.0-beta1, =5.0.0-beta1, =5.0.0-beta1, =5.0.0-beta1, =5.0.0-beta1, =5.2.6 and more Source cves: CVE-2026-54550 Source advisory:...
com.github.robozonky.distribution:robozonky-distribution-aggregate (>=5.6.0-cr-1, <=6.4.1), com.github.robozonky.distribution:robozonky-distribution-installer (>=6.0.0-beta-1, <=6.4.1) +20 more potentially affected by CVE-2026-54550 via org.codehaus.izpack:izpack-installer (>=5.0.0-beta1, <=5.2.6)
org.codehaus.izpack:izpack-installer MAVEN version =5.0.0-beta1, =5.6.0-cr-1, =6.0.0-beta-1, =4.0.0-cr-1, =4.0.0-cr-1, =4.6.0-cr-1, =3.1.0, =3.1.0, =2.0.43, =1.3, =5.0.0-beta1, =5.0.0-beta1, =5.0.0-beta1, =5.0.0-beta1, =5.0.0-beta1, =5.2.6 and more Source cves: CVE-2026-54550 Source advisory:...
IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
Summary IzPack's UnpackerBase.unpack resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR the format is unsigned can include pack entries whose targetPath contains ../ sequences. When a victim runs the...
CVE-2026-54550
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...
CVE-2026-54550 IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...
CVE-2026-54550 IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...
CVE-2026-54550
IzPack versions 5.2.6 and earlier contain a path traversal vulnerability in UnpackerBase.unpack(). The method passes an attacker-controlled PackFile targetPath through IoHelper.translatePath(), which only converts separators without normalizing ../ segments or enforcing directory containment. A t...
CVE-2026-54550 IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...
EUVD-2026-66562
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...
CVE-2026-54550: Improper Limitation of a Pathname to a Restricted Directory
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...
PT-2026-82113
Name of the Vulnerable Software and Affected Versions IzPack versions 5.2.6 and earlier Description IzPack is a tool for packaging Java applications as cross-platform installers. The unpack function within the UnpackerBase class fails to properly validate the targetPath of pack-file entries...