{"schema_version": "1.6.1", "id": "CVE-2026-26032", "summary": "PackagerResolver path traversal vulnerability", "details": "The PackagerResolver of Apache Ivy is able to download online\nartifacts and to (re)package them in a format defined by a\npackager.xml file. This repackaging is done by an Ant script, which is\nstored in a subdirectory of the configured \"buildRoot\" directory. This\nsubdirectory is calculated based on modules coordinates, like the\norganisation, name or version.\n\nIf one of the coordinates contains \"../\" sequences - which are valid\ncharacters for Ivy coordinates in general- it is possible to break out\nof the configured \"buildRoot\" directory where other files can be\noverwritten.\n\nIn order to exploit this vulnerability an attacker needs to have\naccess to a packager repository and add or modify the coordinates in\nivy.xml files to have such \"../\" sequences.\n\nUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "2.0.0"}, {"last_affected": "2.0.0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq"}]}