CVE-2026-26032 Apache Ivy: PackagerResolver path traversal vulnerability

Medium 5.4 Published 15 Jul 2026 Updated 15 Jul 2026

An attacker with access to a packager repository can overwrite files outside the build directory by injecting path traversal sequences into Ivy coordinates.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-26032?

CVE-2026-26032 is a medium-severity path traversal vulnerability in Apache Ivy, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version.

If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten.

In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences.

Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

Weakness: CWE-22

Which versions are affected by CVE-2026-26032?

It affects 1 product.

Linux distribution packages (6)

`apache-commons-compress` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`1.28.0-150200.3.19.1`
`apache-ivy` SUSE:Linux Enterprise Module for Development Tools 15 SP7	All versions	`2.6.0-150200.3.12.1`
`apache-ivy` SUSE:Linux Enterprise Server 16.0	All versions	`2.6.0-160000.1.1`
`apache-ivy` SUSE:Linux Enterprise Server for SAP applications 16.0	All versions	`2.6.0-160000.1.1`
`apache-ivy` openSUSE:Leap 16.0	All versions	`2.6.0-160000.1.1`
`apache-ivy` openSUSE:Tumbleweed	All versions	`2.6.0-1.1`

Products include Apache Ivy.

How do I fix CVE-2026-26032?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-26032 being exploited?

There is no known exploitation of CVE-2026-26032 in the wild and no public exploit code.

Sources

Also known as GHSA-j482-hm6j-v5jj, SUSE-SU-2026:22858-1, SUSE-SU-2026:3225-1, UBUNTU-CVE-2026-26032, openSUSE-SU-2026:11326-1, openSUSE-SU-2026:21424-1.