CVE-2026-26032

Name of the Vulnerable Software and Affected Versions Apache Ivy versions 2.0.0 through 2.5.3

Description The PackagerResolver in Apache Ivy allows the downloading and repackaging of online artifacts based on a packager.xml file. This process uses an Ant script stored in a subdirectory of the buildRoot directory, with the path determined by module coordinates such as organization, name, or version. If these coordinates contain ../ sequences, a path traversal occurs, allowing an attacker to break out of the buildRoot directory and overwrite files. Exploitation requires the attacker to have access to a packager repository to modify coordinates within ivy.xml files.

Recommendations Upgrade to Ivy 2.6.0.