CVE-2026-54550: IzPack Path Traversal Vulnerability

CVE-2026-54550 Overview

CVE-2026-54550 is a path traversal vulnerability [CWE-22] in IzPack, a Java-based tool for building cross-platform application installers. Versions 5.2.6 and earlier fail to normalize or contain attacker-controlled targetPath values inside pack entries. A malicious installer can write files outside the intended installation directory when a victim runs it. Placement into startup folders or executable search paths can lead to code execution under the victim's privileges.

Critical Impact

A crafted IzPack installer can drop files into arbitrary locations on the victim's system, enabling persistence or code execution with the running user's privileges.

Affected Products

• IzPack installer framework, versions 5.2.6 and earlier
• Applications packaged and distributed using vulnerable IzPack releases
• End-user systems executing installers built with vulnerable IzPack versions

Discovery Timeline

• 2026-08-26 - CVE-2026-54550 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54550

Vulnerability Analysis

The flaw resides in UnpackerBase.unpack() within izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java. The method reads the targetPath from a PackFile entry supplied by the installer archive. That value is passed through IoHelper.translatePath(), which only rewrites path separators for the host operating system.

The resulting string is then used to construct a java.io.File without resolving .. segments or verifying that the final path stays inside the intended installation directory. Attackers who control the installer contents can therefore embed ../ sequences in pack entries and direct writes to any location the invoking user can reach.

Because installers frequently run interactively and are trusted by users, the vulnerability provides a reliable primitive for persistence. Writing to Windows Startup folders, ~/.config/autostart on Linux, or directories on the PATH yields code execution at next login or when a hijacked binary is invoked.

Root Cause

The root cause is missing destination containment. translatePath() normalizes only separator characters and does not canonicalize the path or reject parent-directory traversal. The PackFile constructor and UnpackerBase did not enforce that resolved targets remained under the installation root before file creation.

Attack Vector

Exploitation requires an attacker to distribute a malicious IzPack installer and a victim to execute it. Delivery vectors include supply-chain compromise of build pipelines, typosquatting of legitimate installer downloads, or repackaging of trusted applications. No network access to the victim host is required beyond delivery of the installer.

// Patch excerpt from PackFile.java — IZPACK-1820 adds path traversal checks
public PackFile(File baseDir, File src, String target, List<OsModel> osList, OverrideType override,
                String overrideRenameTo, Blockable blockable, Map<String, String> pack200Properties)
        throws IOException
{
    this(src, FileUtil.getRelativeFileName(src, baseDir), target, osList, override, overrideRenameTo, blockable,
            null, pack200Properties);
}
// Source: https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8

// Patch excerpt from AbstractInstallDataProvider.java — introduces java.nio.file for safe path validation
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.net.InetAddress;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.*;
import java.util.logging.Level;
import java.util.logging.Logger;
// Source: https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466

Detection Methods for CVE-2026-54550

Indicators of Compromise

• File writes originating from a java or IzPack installer process into paths outside the user-selected installation directory
• New files in autostart locations such as %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup or ~/.config/autostart created during installer execution
• Modifications to directories on the system PATH (e.g., /usr/local/bin, C:\Windows\System32) coinciding with installer runs

Detection Strategies

• Hunt for java.exe or javaw.exe child processes writing files whose canonical path is not a subpath of the installer's chosen destination
• Inspect IzPack-built installers statically for pack entries whose targetPath contains .. segments before distribution
• Flag installer executions that produce writes to shell startup files, cron directories, service unit directories, or Registry Run keys

Monitoring Recommendations

• Enable file integrity monitoring on autostart, PATH, and system binary directories
• Capture process-and-file telemetry from endpoint agents and retain it for correlation across installer sessions
• Alert on Java-based installers spawning follow-on processes from newly written locations

How to Mitigate CVE-2026-54550

Immediate Actions Required

• Upgrade IzPack to a fixed release that includes commits 4233ba3 and 8b7c679 and rebuild all installers
• Re-sign and re-publish any application installers previously built with IzPack 5.2.6 or earlier
• Instruct users to obtain installers only from verified sources and to verify digital signatures before execution

Patch Information

The fix is tracked as IZPACK-1820 and merged via GitHub Pull Request #1193. Relevant commits are 4233ba3 and 8b7c679. Full advisory details are in GHSA-f63g-88cj-hjf9. The patch introduces java.nio.file.Path handling and enforces destination containment during unpack.

Workarounds

• Run installers inside an unprivileged sandbox account or container with no write access to autostart or PATH directories
• Statically scan IzPack pack archives and reject any entry whose targetPath contains .. or absolute path components
• Restrict installer execution through application allowlisting until packages are rebuilt on a patched IzPack release

# Quickly inspect an IzPack installer for suspicious pack entries containing traversal sequences
unzip -l installer.jar | awk '{print $4}' | grep -E '(^/|\.\./)' && echo 'Suspicious paths detected'