CVE-2026-26032

Katalog CVE

CVSS 5.4 · Medium EPSS 0,51%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada apache ivy. Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq mitigasi · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/07/15/5 mailing list · advisory pihak ketiga