VulnSocial

CVE-2026-54550General

LOWCVSS 7.4 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim's privileges when the victim runs the installer.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-08-30)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-08-26: 1Mentions · 2026-08-30: 2Technical Details · 2026-08-26: 108-2608-30
Signal classification2 categories
General
266.7%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-261
Disclosure1
2026-08-302
General2
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-54550 IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-insta… https://www.cve.org/CVERecord?id=CVE-2026-54550 ----- Traducción: CVE-2026-54550 IzP… https://infoflow.cloud`

    Post summary

    The post cites CVE-2026-54550 and links to its record, but provides no information on exploits, patches, active misuse, or detailed technical data.

    0000065
    102 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-54550 IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-insta… https://www.cve.org/CVERecord?id=CVE-2026-54550

    Post summary

    The notice cites CVE‑2026‑54550 affecting IzPack’s UnpackerBase.unpack() in versions 5.2.6 and earlier, but offers no details on exploitation, patches, or active attacks.

    00000734
    58.0K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 IzPack, Path Traversal, #CVE-2026-54550 (High) -DC-Aug2026-1929 https://dailycve.com/izpack-path-traversal-cve-2026-54550-high-dc-aug2026-1929/

    Post summary

    A high‑severity path traversal vulnerability (CVE‑2026‑54550) in IzPack has been disclosed.

    0000033
    231 followersView on X

Explore more

Back to dashboard