High, CVSS 7.4MavenAmendedPublished
IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
CVE-2026-54550 · GHSA-f63g-88cj-hjf9
- Affected
- Maven org.codehaus.izpack:izpack-installer < 5.2.7
- Fixed in
- 5.2.7· Vendor fix available
- Issue
- IzPack's `UnpackerBase.unpack()` resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR (the format is unsigned) can include pack entries whose `targetPath` contains `../` sequences. When a victim runs the installer the file is written to an attacker-chosen location on disk under the victim's privileges — including startup folders, PATH directories, or system locations. Details Vulnerable method: `com.izforge.izpack.installer.unpacker.UnpackerBase.unpack()` Source file: `izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java` Vulnerable lines (5.2.4): ~618–627 The relevant code path is: ```java String targetPath = packFile.getTargetPath(); // attacker-controlled String path = IoHelper.translatePath(targetPath, variables); // separator swap ONLY File target = new File(path); // no canonical check // ... mkdirs() then file is written to…
Recommended action: Upgrade to 5.2.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.