CVE-2026-26032: Apache Ivy Path Traversal Vulnerability

CVE-2026-26032 Overview

CVE-2026-26032 is a path traversal vulnerability [CWE-22] in the PackagerResolver component of Apache Ivy. The resolver downloads online artifacts and repackages them using an Ant script stored in a subdirectory of the configured buildRoot directory. The target subdirectory is derived from module coordinates such as organisation, name, and version. Because Ivy permits ../ sequences within coordinate values, an attacker with access to a packager repository can escape the buildRoot directory and overwrite arbitrary files. The issue affects Apache Ivy versions 2.0.0 through 2.5.3.

Critical Impact
Attackers with packager repository access can write files outside the intended buildRoot directory, enabling overwrite of sensitive files on the build host.

Affected Products

Apache Ivy 2.0.0 through 2.5.3 (inclusive)
Build environments using PackagerResolver with untrusted packager repositories
CI/CD pipelines consuming Ivy-managed dependencies via packager repositories

Discovery Timeline

2026-07-15 - CVE-2026-26032 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-26032

Vulnerability Analysis

Apache Ivy's PackagerResolver fetches remote artifacts and repackages them locally using an Ant script defined in a packager.xml file. Ivy constructs the working directory path by concatenating the configured buildRoot with values derived from module coordinates. Ivy accepts ../ as valid characters within these coordinate strings. When those sequences are present in the organisation, module name, or version, path resolution traverses upward out of buildRoot. The Ant script then executes with write access to arbitrary filesystem locations reachable by the build user.

Root Cause

The root cause is insufficient sanitization of module coordinate values used to build filesystem paths [CWE-22]. Ivy trusts coordinate strings from ivy.xml files and does not normalize or reject sequences that navigate outside the intended base directory. The concatenated path is passed directly to the repackaging routine without validation against the buildRoot boundary.

Attack Vector

Exploitation requires an attacker to have write access to a packager repository consumed by an Ivy build. The attacker modifies or introduces an ivy.xml file whose organisation, name, or version fields contain ../ segments. When a downstream build resolves these coordinates through PackagerResolver, the generated build subdirectory resolves to a location outside buildRoot. Files at that location may be created or overwritten under the privileges of the build process. This can lead to source tampering, injection of malicious artifacts, or corruption of configuration on the build host.

No verified public exploit code is available. See the Apache Security Thread and the OpenWall OSS Security Update for advisory details.

Detection Methods for CVE-2026-26032

Indicators of Compromise

Presence of ../ sequences within organisation, module, or revision attributes in ivy.xml files pulled from packager repositories.
Files modified outside the configured buildRoot directory during or after an Ivy resolution run.
Unexpected Ant script execution touching paths such as /etc, user home directories, or build tool configuration outside the workspace.

Detection Strategies

Scan all ivy.xml files in build inputs and packager repositories for coordinate values containing .., forward slashes, or backslashes.
Enable filesystem auditing on the build host and alert on writes originating from Ivy or Ant processes that fall outside the declared buildRoot.
Compare pre- and post-build filesystem state to identify unauthorized file modifications during dependency resolution.

Monitoring Recommendations

Log and review changes to packager repository contents, including who added or modified ivy.xml and packager.xml files.
Monitor build agents for anomalous process activity from java invocations of Ivy that write outside expected directories.
Track the installed Apache Ivy version across build infrastructure to identify systems still running 2.0.0 through 2.5.3.

How to Mitigate CVE-2026-26032

Immediate Actions Required

Upgrade Apache Ivy to version 2.6.0 on all build systems and developer workstations.
Audit all packager repositories for ivy.xml files containing ../ sequences in module coordinates and remove or correct them.
Restrict write access to packager repositories to trusted maintainers only.
Run Ivy builds under least-privilege accounts that cannot overwrite sensitive system or application files.

Patch Information

Apache Ivy 2.6.0 addresses CVE-2026-26032 by preventing coordinate values from escaping the buildRoot directory. Users of Apache Ivy 2.0.0 through 2.5.3 should upgrade immediately. Refer to the Apache Security Thread for release details.

Workarounds

Disable use of PackagerResolver where packager repositories are not fully trusted.
Enforce validation on ivy.xml submissions to reject any coordinate containing .., /, or \ characters before ingestion.
Isolate Ivy build execution inside ephemeral containers or sandboxes so that any out-of-directory writes are contained.

bash

# Example: reject ivy.xml files containing traversal sequences before build
grep -RIn --include='ivy.xml' -E 'organisation="[^"]*\.\.|module="[^"]*\.\.|revision="[^"]*\.\.' ./repository \
  && { echo "Traversal sequence detected in ivy coordinates"; exit 1; }