CVE-2026-54550: IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
(updated )
IzPack’s UnpackerBase.unpack() resolves pack-file target paths without any
canonical-path or directory-containment check. An attacker who distributes a
trojanized installer JAR (the format is unsigned) can include pack entries whose
targetPath contains ../ sequences. When a victim runs the installer the
file is written to an attacker-chosen location on disk under the victim’s
privileges — including startup folders, PATH directories, or system locations.
References
- github.com/advisories/GHSA-f63g-88cj-hjf9
- github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8
- github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466
- github.com/izpack/izpack/pull/1193
- github.com/izpack/izpack/releases/tag/izpack-5.2.7
- github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9
- nvd.nist.gov/vuln/detail/CVE-2026-54550
Code Behaviors & Features
Detect and mitigate CVE-2026-54550 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →