Description
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.
In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Ivy | >= 2.0.0, <= 2.5.3 |
References
- https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyqMitigation, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/15/5Mailing List, Third Party Advisory
Timeline
- Published
- Jul 15, 2026
- Last modified
- Oct 24, 2026
- NVD status
- Analyzed