CVE-2026-26032

{"id": "CVE-2026-26032", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26032", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T19:27:06.913586Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Ivy", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.5.3"}], "packageName": "org.apache.ivy:ivy", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-15T19:17:10.447", "references": [{"url": "https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq", "tags": ["Mitigation", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/15/5", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The PackagerResolver of Apache Ivy is able to download online\nartifacts and to (re)package them in a format defined by a\npackager.xml file. This repackaging is done by an Ant script, which is\nstored in a subdirectory of the configured \"buildRoot\" directory. This\nsubdirectory is calculated based on modules coordinates, like the\norganisation, name or version.\n\nIf one of the coordinates contains \"../\" sequences - which are valid\ncharacters for Ivy coordinates in general- it is possible to break out\nof the configured \"buildRoot\" directory where other files can be\noverwritten.\n\nIn order to exploit this vulnerability an attacker needs to have\naccess to a packager repository and add or modify the coordinates in\nivy.xml files to have such \"../\" sequences.\n\nUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."}, {"lang": "es", "value": "El PackagerResolver de Apache Ivy es capaz de descargar artefactos en l\u00ednea y de (re)empaquetarlos en un formato definido por un archivo packager.xml. Este reempaquetado se realiza mediante un script Ant, el cual se almacena en un subdirectorio del directorio \u201cbuildRoot\u201d configurado. Este subdirectorio se calcula bas\u00e1ndose en las coordenadas de los m\u00f3dulos, como la organizaci\u00f3n, el nombre o la versi\u00f3n.\n\nSi una de las coordenadas contiene secuencias \u201c.. / \u201d - las cuales son caracteres v\u00e1lidos para las coordenadas de Ivy en general- es posible salirse del directorio \u201cbuildRoot\u201d configurado donde otros archivos pueden ser sobrescritos.\n\nPara explotar esta vulnerabilidad un atacante necesita tener acceso a un repositorio de empaquetador y a\u00f1adir o modificar las coordenadas en los archivos ivy.xml para que contengan dichas secuencias \u201c.. / \u201d.\n\nLos usuarios de Apache Ivy 2.0.0 a 2.5.3 (inclusive) deber\u00edan actualizar a Ivy 2.6.0."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:ivy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ADB6759-D408-41BE-B132-9040F35B30B2", "versionEndExcluding": "2.6.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}