Executive brief
Apache Ivy, a popular tool for managing project dependencies, contains a security flaw in its artifact packaging component. An attacker who can control project metadata could potentially overwrite sensitive files on the system where the software is being built. This could lead to unauthorized system changes or disruption of the software development process.
Technical details
A path traversal vulnerability (CWE-22) exists in the PackagerResolver of Apache Ivy. The component uses module coordinates (such as organization, name, or version) to determine the subdirectory within the 'buildRoot' where Ant scripts for repackaging are stored. Because Ivy does not properly sanitize '../' sequences in these coordinates, an attacker with the ability to modify or provide a malicious ivy.xml file in a packager repository can escape the designated build directory. This allows the attacker to overwrite files outside of the 'buildRoot' during the repackaging process. The vulnerability is addressed in version 2.6.0.
Affected products
- Apache Software Foundation Ivy 2.0.0 to 2.5.3
Timeline
- 2026-07-15: disclosed: Initial disclosure by Apache Software Foundation
- 2026-07-15: advisory: NVD publication date