CVE-2026-26032

{
  "id": "CVE-2026-26032",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T19:17:10.447",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The PackagerResolver of Apache Ivy is able to download online\nartifacts and to (re)package them in a format defined by a\npackager.xml file. This repackaging is done by an Ant script, which is\nstored in a subdirectory of the configured \"buildRoot\" directory. This\nsubdirectory is calculated based on modules coordinates, like the\norganisation, name or version.\n\nIf one of the coordinates contains \"../\" sequences - which are valid\ncharacters for Ivy coordinates in general- it is possible to break out\nof the configured \"buildRoot\" directory where other files can be\noverwritten.\n\nIn order to exploit this vulnerability an attacker needs to have\naccess to a packager repository and add or modify the coordinates in\nivy.xml files to have such \"../\" sequences.\n\nUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."
    },
    {
      "lang": "es",
      "value": "El PackagerResolver de Apache Ivy es capaz de descargar artefactos en línea y de (re)empaquetarlos en un formato definido por un archivo packager.xml. Este reempaquetado se realiza mediante un script Ant, el cual se almacena en un subdirectorio del directorio “buildRoot” configurado. Este subdirectorio se calcula basándose en las coordenadas de los módulos, como la organización, el nombre o la versión.\n\nSi una de las coordenadas contiene secuencias “.. / ” - las cuales son caracteres válidos para las coordenadas de Ivy en general- es posible salirse del directorio “buildRoot” configurado donde otros archivos pueden ser sobrescritos.\n\nPara explotar esta vulnerabilidad un atacante necesita tener acceso a un repositorio de empaquetador y añadir o modificar las coordenadas en los archivos ivy.xml para que contengan dichas secuencias “.. / ”.\n\nLos usuarios de Apache Ivy 2.0.0 a 2.5.3 (inclusive) deberían actualizar a Ivy 2.6.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Ivy",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.ivy:ivy",
          "versions": [
            {
              "version": "2.0.0",
              "lessThanOrEqual": "2.5.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T19:27:06.913586Z",
          "id": "CVE-2026-26032",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:ivy:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "2.6.0",
              "matchCriteriaId": "8ADB6759-D408-41BE-B132-9040F35B30B2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/15/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}