CVE-2026-26032

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

• CWE-22

• https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyqMitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/07/15/5Mailing List, Third Party Advisory

Published

Jul 15, 2026

Last Modified

Jul 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26027GLPI is a free asset and IT management software package. Fro…6.1
• CVE-2026-26028CryptPad is an end-to-end encrypted collaborative office sui…6.1
• CVE-2026-26029sf-mcp-server is an implementation of Salesforce MCP server …7.5
• CVE-2026-2603A flaw was found in Keycloak. A remote attacker could bypass…8.1
• CVE-2026-26030Semantic Kernel, Microsoft's semantic kernel Python SDK, has…9.9
• CVE-2026-26031Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-26033UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (…8.4
• CVE-2026-26034UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (…8.5
• CVE-2026-26035An Improper Authentication vulnerability [CWE-287] vulnerabi…9.8
• CVE-2026-26036Rejected reason: Not used
• CVE-2026-26037Rejected reason: Not used
• CVE-2026-26038Rejected reason: Not used