CVE-2026-54550 IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
Attackers can write files outside the installation directory via malicious pack entries, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54550?
CVE-2026-54550 is a high-severity path traversal vulnerability in izpack, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim's privileges when the victim runs the installer.
Weakness: CWE-22
Which versions are affected by CVE-2026-54550?
2 open source packages ship an affected version, including org.codehaus.izpack:izpack-installer.
| Package | Affected | Fixed in |
|---|---|---|
org.codehaus.izpack:izpack-installer Maven | All versions | 5.2.7 |
org.codehaus.izpack:izpack-installer Maven | All versions | 5.2.7 |
How do I fix CVE-2026-54550?
Upgrade org.codehaus.izpack:izpack-installer to 5.2.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54550 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54550 exists.
Sources
Also known as GHSA-f63g-88cj-hjf9.