CVE-2026-26032Disclosure(apache / ivy)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

apache

Products

ivy

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.openwall.com/lists/oss-security/2026/07/15/5

Full discourse1 post

Open Source Security mailing list@oss_security92d
Disclosure
CVE-2026-26032: Apache Ivy: PackagerResolver path traversal https://www.openwall.com/lists/oss-security/2026/07/15/5 Severity: moderate attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have "../" sequences
Post summary
The message announces CVE-2026-26032, describing a path traversal flaw in Apache Ivy’s PackagerResolver that requires manipulating ivy.xml files, but provides no proof of concept, exploit code, or mitigation details.
00031642
4.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	ivy	-	-	-

Explore more

Back to dashboard apache CVEs ivy vulnerabilities