CVE-2026-26032

A flaw was found in Apache Ivy's PackagerResolver. An attacker with access to a packager repository can exploit this by injecting specially crafted module coordinates into ivy.xml files. These malicious coordinates, containing directory traversal sequences, allow the attacker to overwrite files outside the intended build directory. This could lead to unauthorized modification of system files.

A flaw was found in Apache Ivy's PackagerResolver. Exploitation requires an attacker to have write access to a packager repository consumed by the victim's build configuration, and the victim must be using the PackagerResolver feature, which is not a default Ivy configuration. These preconditions significantly limit the real-world exploitability of this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is available for this vulnerability.