CVE-2026-54550: Path Traversal Vulnerability in IzPack Installer Unpacker
Vulnerability ID: CVE-2026-54550
CVSS Score: 7.4
Published: 2026-08-26
IzPack versions 5.2.6 and earlier are vulnerable to path traversal via UnpackerBase.unpack(). The vulnerability allows unauthenticated attackers to write arbitrary files to the host filesystem during the installation process by crafting malicious installer packages containing directory traversal sequences.
TL;DR
IzPack installers prior to 5.2.7 do not validate target extraction paths, allowing malicious packages to write files outside the installation folder, potentially achieving persistent code execution.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network / User Interaction
- CVSS Score: 7.4
- EPSS Score: Not Indexed
- Impact: Arbitrary File Write / Local Privilege Escalation
- Exploit Status: Proof of Concept
- KEV Status: Not Listed
Affected Systems
- IzPack Installer Framework installations using 5.2.6 or older
-
IzPack: <= 5.2.6 (Fixed in:
5.2.7)
Code Analysis
Commit: 4233ba3
Add path validation and directory containment audit logs to prevent traversal tricks.
Commit: 8b7c679
Backport path traversal validation checks and integrate Windows specific reserved name mitigations.
Mitigation Strategies
- Upgrade IzPack compilation tools to version 5.2.7 or higher.
- Recompile and rebuild existing deployment packages.
- Perform inspection of legacy metadata to identify suspicious directory structures.
Remediation Steps:
- Update the build configuration dependencies to point to IzPack 5.2.7.
- Verify that the build outputs do not contain nested traversals.
- Deploy the updated installers to users and deprecate old versions.
References
Read the full report for CVE-2026-54550 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)