Skip to main content

Apache Ivy CVE-2026-26032

| EUVDEUVD-2026-44763 MEDIUM
Path Traversal (CWE-22)
2026-07-15
Apache Path Traversal Red Hat Suse Ivy
5.4
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Network-reachable via repository fetch but AC:H (attacker must control a trusted repo); PR:L for required repo write access; UI:R for mandatory developer-initiated build; S:C as traversal escapes buildRoot; I:H for arbitrary file overwrite; A:L for potential build disruption.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:L
4.0 AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
CVSS changed
Jul 15, 2026 - 20:22 NVD
5.4 (MEDIUM)
Analysis Generated
Jul 15, 2026 - 16:20 vuln.today
CVE Published
Jul 15, 2026 - 15:34 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Path Traversal in Apache Ivy PackagerResolver - CVE-2026-26032 Jul 15, 2026

AnalysisAI

Path traversal in Apache Ivy's PackagerResolver (versions 2.0.0 through 2.5.3) allows an attacker with write access to a packager repository to overwrite arbitrary files outside the configured buildRoot directory by embedding '../' sequences in module coordinates such as organisation, name, or revision. The overwrite occurs during the Ant-script-driven repackaging phase that PackagerResolver triggers on artifact download. No public exploit code has been identified at time of analysis, and the vendor has released version 2.6.0 as the fix, confirmed via the Apache Ant project site on July 14, 2026.

Technical ContextAI

Apache Ivy (org.apache.ivy:ivy) is a dependency management tool designed to integrate with Apache Ant build systems. The PackagerResolver is a specialized resolver that fetches remote artifacts and repackages them using an Ant script defined in a packager.xml file. The Ant script is placed in a subdirectory of the operator-configured 'buildRoot' directory, and that subdirectory path is assembled by concatenating module coordinate fields - organisation, name, and version - directly into a filesystem path. Because Ivy does not restrict or canonicalize these coordinate values before path construction, a coordinate containing '../' sequences (which are syntactically valid in Ivy) can escape the intended buildRoot subtree. The root-cause class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), triggered by unsanitized user-controlled input being concatenated into a file-system path. Only installations actively using the PackagerResolver and resolving from an attacker-influenced repository are in scope; common resolvers such as IBiblioResolver or FileSystemResolver are unaffected.

RemediationAI

Upgrade to Apache Ivy 2.6.0, released July 14, 2026, available for download at https://ant.apache.org/ivy/download.cgi. This is the vendor-confirmed fix and the only fully remediated version. As a compensating control for teams unable to upgrade immediately, disable or remove any PackagerResolver declarations from Ivy configuration files - this eliminates the vulnerable code path entirely, though it prevents use of packager-based artifact repackaging. Additionally, restrict write access to all packager repositories consumed by your build environment to trusted contributors only, reducing the attacker's ability to inject malicious coordinates. If using a private Nexus or Artifactory mirror that proxies packager repositories, verify that only vetted artifacts are cached. Note that disabling the PackagerResolver may break builds that depend on it for native or custom-packaged artifacts.

More in Ivy

View all
CVE-2022-37865 CRITICAL
9.1 Nov 07

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fl
CVE-2022-37866 HIGH
7.5 Nov 07

When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "
CVE-2023-41938 MEDIUM
6.5 Sep 06

A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disab

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-26032 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy