Executive brief
IzPack is a Java-based installer framework widely used to deploy applications across Windows, Linux, and macOS. The vulnerability allows an attacker who repackages an installer to write arbitrary files outside the intended installation directory when a user runs the trojanized installer. Since IzPack installers are typically unsigned and often run with administrator privileges on Windows, an attacker can place malicious executables in startup folders or system directories, achieving code execution with elevated privileges.
Technical details
The vulnerability exists in com.izforge.izpack.installer.unpacker.UnpackerBase.unpack() (lines ~618–627 in version 5.2.4), where pack-file target paths are resolved without canonical-path validation or directory-containment checks. The IoHelper.translatePath() helper performs only file-separator character conversion ('/' to File.separatorChar) and contains no security filtering of `..` path traversal sequences. Because IzPack installer JARs carry no digital signature and use standard ZIP format with serialised resources, an attacker can repack a legitimate installer with arbitrary malicious PackFile entries. The attack requires only that a victim execute the installer; no authentication or special privileges beyond those the installer runs with are needed. The PoC demonstrates that files can be written outside the installation directory to arbitrary locations like /tmp/ESCAPED_FILE on Unix or %SystemRoot%\System32 on Windows.
Affected products
- IzPack izpack-installer <= 5.2.6
Timeline
- 2026-07-17: disclosed: Published in GitHub Advisory Database
- 2026-08-26: advisory: GHSA-f63g-88cj-hjf9 and CVE-2026-54550 published