CVE-2026-26032 Details
Description
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
A path traversal vulnerability has been identified in the PackagerResolver component of Apache Ivy versions 2.0.0 through 2.5.3. This vulnerability allows an attacker to manipulate module coordinates in Ivy XML files to include '../' sequences, which can break out of the designated 'buildRoot' directory. As a result, files outside this directory can be overwritten. The issue arises because the PackagerResolver can download online artifacts and repackage them according to a user-defined packager.xml file, using an Ant script stored in a subdirectory calculated from the module coordinates. Exploitation requires access to a packager repository to modify Ivy coordinates.
Users of Apache Ivy should upgrade to version 2.6.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/15/5 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache ivy | >= 2.0.0, < 2.6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | CVE Modified | CVE |
| Jul 15, 2026 | New CVE Received | [email protected] |