CVE-2026-26032

A flaw was found in Apache Ivy's PackagerResolver. An attacker with access to a packager repository can exploit this by injecting specially crafted module coordinates into ivy.xml files. These malicious coordinates, containing directory traversal sequences, allow the attacker to overwrite files...

Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni

This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue Security issues fixed: CVE-2026-26032: improper pathname limitation in PackagerResolver allows for arbitrary files writes outside of the configured buildRoot directory bsc1271727. Other updates an...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the PackagerResolver process. An attacker can overwrite files outside the intended buildRoot directory by supplying specially crafted module coordinates containing directory traversal sequences. This is only...

UBUNTU-CVE-2026-26032

The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...

CVE-2026-26032 Apache Ivy: PackagerResolver path traversal vulnerability

The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...

PT-2026-60263

Name of the Vulnerable Software and Affected Versions Apache Ivy versions 2.0.0 through 2.5.3 Description The PackagerResolver in Apache Ivy allows the downloading and repackaging of online artifacts based on a packager.xml file. This process uses an Ant script stored in a subdirectory of the...