CVE-2026-54550

Name of the Vulnerable Software and Affected Versions IzPack versions 5.2.6 and earlier

Description IzPack is a tool for packaging Java applications as cross-platform installers. The unpack() function within the UnpackerBase class fails to properly validate the targetPath of pack-file entries. Specifically, the IoHelper.translatePath() function only converts file separators and does not normalize parent-directory segments or enforce destination containment. This allows an attacker to distribute a trojanized installer containing ../ sequences in the targetPath variable, enabling the writing of files outside the intended installation directory. This can lead to files being placed in startup folders, executable search paths, or other sensitive locations with the privileges of the user running the installer.

Recommendations As a temporary workaround, restrict the execution of installers from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.