CVE-2026-26032

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26032", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-02-09T22:55:23.574Z", "datePublished": "2026-07-15T18:49:43.153Z", "dateUpdated": "2026-07-15T19:31:07.994Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.ivy:ivy", "product": "Apache Ivy", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.5.3", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "yudeshui of dhgate security"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The PackagerResolver of Apache Ivy is able to download online<br>artifacts and to (re)package them in a format defined by a<br>packager.xml file. This repackaging is done by an Ant script, which is<br>stored in a subdirectory of the configured \"buildRoot\" directory. This<br>subdirectory is calculated based on modules coordinates, like the<br>organisation, name or version.<br><br>If one of the coordinates contains \"../\" sequences - which are valid<br>characters for Ivy coordinates in general- it is possible to break out<br>of the configured \"buildRoot\" directory where other files can be<br>overwritten.<br><br>In order to exploit this vulnerability an attacker needs to have<br>access to a packager repository and add or modify the coordinates in<br>ivy.xml files to have such \"../\" sequences.<br><br>Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."}], "value": "The PackagerResolver of Apache Ivy is able to download online\nartifacts and to (re)package them in a format defined by a\npackager.xml file. This repackaging is done by an Ant script, which is\nstored in a subdirectory of the configured \"buildRoot\" directory. This\nsubdirectory is calculated based on modules coordinates, like the\norganisation, name or version.\n\nIf one of the coordinates contains \"../\" sequences - which are valid\ncharacters for Ivy coordinates in general- it is possible to break out\nof the configured \"buildRoot\" directory where other files can be\noverwritten.\n\nIn order to exploit this vulnerability an attacker needs to have\naccess to a packager repository and add or modify the coordinates in\nivy.xml files to have such \"../\" sequences.\n\nUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-15T18:49:43.153Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Ivy: PackagerResolver path traversal vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T19:27:06.913586Z", "id": "CVE-2026-26032", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T19:27:55.061Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/15/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-15T19:31:07.994Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26032", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-02-09T22:55:23.574Z", "datePublished": "2026-07-15T18:49:43.153Z", "dateUpdated": "2026-07-15T19:27:55.061Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.ivy:ivy", "product": "Apache Ivy", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.5.3", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "yudeshui of dhgate security"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The PackagerResolver of Apache Ivy is able to download online<br>artifacts and to (re)package them in a format defined by a<br>packager.xml file. This repackaging is done by an Ant script, which is<br>stored in a subdirectory of the configured \"buildRoot\" directory. This<br>subdirectory is calculated based on modules coordinates, like the<br>organisation, name or version.<br><br>If one of the coordinates contains \"../\" sequences - which are valid<br>characters for Ivy coordinates in general- it is possible to break out<br>of the configured \"buildRoot\" directory where other files can be<br>overwritten.<br><br>In order to exploit this vulnerability an attacker needs to have<br>access to a packager repository and add or modify the coordinates in<br>ivy.xml files to have such \"../\" sequences.<br><br>Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."}], "value": "The PackagerResolver of Apache Ivy is able to download online\nartifacts and to (re)package them in a format defined by a\npackager.xml file. This repackaging is done by an Ant script, which is\nstored in a subdirectory of the configured \"buildRoot\" directory. This\nsubdirectory is calculated based on modules coordinates, like the\norganisation, name or version.\n\nIf one of the coordinates contains \"../\" sequences - which are valid\ncharacters for Ivy coordinates in general- it is possible to break out\nof the configured \"buildRoot\" directory where other files can be\noverwritten.\n\nIn order to exploit this vulnerability an attacker needs to have\naccess to a packager repository and add or modify the coordinates in\nivy.xml files to have such \"../\" sequences.\n\nUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-15T18:49:43.153Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Ivy: PackagerResolver path traversal vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-26032", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T19:27:06.913586Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T19:27:51.628Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.ivy:ivy", "product": "Apache Ivy", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.5.3", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:ivy:*:*:*:*:*:*:*:*", "matchCriteriaId": "8ADB6759-D408-41BE-B132-9040F35B30B2", "versionEndExcluding": "2.6.0", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PackagerResolver of Apache Ivy is able to download online\nartifacts and to (re)package them in a format defined by a\npackager.xml file. This repackaging is done by an Ant script, which is\nstored in a subdirectory of the configured \"buildRoot\" directory. This\nsubdirectory is calculated based on modules coordinates, like the\norganisation, name or version.\n\nIf one of the coordinates contains \"../\" sequences - which are valid\ncharacters for Ivy coordinates in general- it is possible to break out\nof the configured \"buildRoot\" directory where other files can be\noverwritten.\n\nIn order to exploit this vulnerability an attacker needs to have\naccess to a packager repository and add or modify the coordinates in\nivy.xml files to have such \"../\" sequences.\n\nUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."}, {"lang": "es", "value": "El PackagerResolver de Apache Ivy es capaz de descargar artefactos en l\u00ednea y de (re)empaquetarlos en un formato definido por un archivo packager.xml. Este reempaquetado se realiza mediante un script Ant, el cual se almacena en un subdirectorio del directorio \u201cbuildRoot\u201d configurado. Este subdirectorio se calcula bas\u00e1ndose en las coordenadas de los m\u00f3dulos, como la organizaci\u00f3n, el nombre o la versi\u00f3n.\n\nSi una de las coordenadas contiene secuencias \u201c.. / \u201d - las cuales son caracteres v\u00e1lidos para las coordenadas de Ivy en general- es posible salirse del directorio \u201cbuildRoot\u201d configurado donde otros archivos pueden ser sobrescritos.\n\nPara explotar esta vulnerabilidad un atacante necesita tener acceso a un repositorio de empaquetador y a\u00f1adir o modificar las coordenadas en los archivos ivy.xml para que contengan dichas secuencias \u201c.. / \u201d.\n\nLos usuarios de Apache Ivy 2.0.0 a 2.5.3 (inclusive) deber\u00edan actualizar a Ivy 2.6.0."}], "id": "CVE-2026-26032", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26032", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T19:27:06.913586Z", "version": "2.0.3"}}]}, "published": "2026-07-15T19:17:10.447", "references": [{"source": "security@apache.org", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/07/15/5"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.5.3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Ivy", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "ivy", "vendor": "apache"}], "created": "2026-07-15T22:00:06.048858+00:00", "updated": "2026-07-31T03:15:04.311354+00:00", "vendors": ["apache", "apache$PRODUCT$ivy"]}