{"id":"CVE-2026-54550","kind":"vulnerability","aliases":["CVE-2026-54550","GHSA-f63g-88cj-hjf9"],"related":[],"title":"IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries","description":"### Summary\n\nIzPack's `UnpackerBase.unpack()` resolves pack-file target paths without any\ncanonical-path or directory-containment check. An attacker who distributes a\ntrojanized installer JAR (the format is unsigned) can include pack entries whose\n`targetPath` contains `../` sequences. When a victim runs the installer the\nfile is written to an attacker-chosen location on disk under the victim's\nprivileges — including startup folders, PATH directories, or system locations.\n\n### Details\n\n**Vulnerable method:** `com.izforge.izpack.installer.unpacker.UnpackerBase.unpack()`\n**Source file:** `izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java`\n**Vulnerable lines (5.2.4):** ~618–627\n\nThe relevant code path is:\n\n```java\nString targetPath = packFile.getTargetPath();             // attacker-controlled\nString path       = IoHelper.translatePath(targetPath, variables); // separator swap ONLY\nFile   target     = new File(path);                       // no canonical check\n// ... mkdirs() then file is written to `target`\n```\n\n`IoHelper.translatePath()` (source: `izpack-util/.../IoHelper.java`) performs\n**only** file-separator character conversion (`'/'` ↔ `File.separatorChar`) and\ncontains no security validation whatsoever. There is no call to\n`getCanonicalPath()`, no `startsWith(installDir)` containment check, and no\nnormalisation of `..` segments.\n\nBecause IzPack installer JARs carry **no digital signature**, an attacker can\nrepack any legitimate installer with malicious `PackFile` entries. The file\nformat is a standard ZIP with serialised resources — no integrity protection.\n\n**Confirmed unpatched in HEAD (fetched from GitHub, 2025):**\n```\ngit show HEAD:izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java \\\n  | grep -n 'getCanonicalPath\\|startsWith.*install\\|traversal'\n# (no output — fix not present)\n```\n\n### PoC\n\n```bash\n# 1. Clone IzPack source and view the vulnerable code directly\ngit clone --depth=1 --branch izpack-5.2.4 https://github.com/izpack/izpack.git\nsed -n '615,650p' izpack/izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java\n\n# 2. Compile and run the following Java reproducer (no IzPack classpath needed):\n```\n\n```java\n// TestPathTraversal.java\nimport java.io.*;\n\npublic class TestPathTraversal {\n    // Exact replication of IoHelper.translatePath() — separator swap, no security\n    static String translatePath(String destination) {\n        return destination.replace('/', File.separatorChar);\n    }\n\n    public static void main(String[] args) throws Exception {\n        String installDir   = \"/tmp/izpack_install\";\n        String maliciousPath = installDir + \"/../../../tmp/ESCAPED_FILE\";\n\n        // This is what UnpackerBase does:\n        String path   = translatePath(maliciousPath);\n        File   target = new File(path);           // resolves traversal\n        target.getParentFile().mkdirs();\n        try (FileWriter fw = new FileWriter(target)) {\n            fw.write(\"Written outside install dir via IzPack path traversal\\n\");\n        }\n        System.out.println(\"File written to: \" + target.getCanonicalPath());\n        System.out.println(\"Inside installDir: \" +\n            target.getCanonicalPath().startsWith(new File(installDir).getCanonicalPath()));\n    }\n}\n```\n\n```bash\njavac TestPathTraversal.java && java TestPathTraversal\n# Output: File written to: /tmp/ESCAPED_FILE\n#         Inside installDir: false\n```\n\n### Impact\n\nAny user who runs an IzPack-generated installer is affected. The attacker only\nneeds to distribute a repackaged installer — a common social-engineering vector.\nOn Windows (the primary IzPack platform) the victim typically runs the installer\nas a local administrator, so the attacker can write to `%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup`,\n`%SystemRoot%\\System32`, or any other location reachable by the victim user.\nOn Linux/macOS the same applies for user-writable locations.\n\nNo authentication, no special privileges and no interaction beyond running the\ninstaller are required on the victim side.\n\n### Credits\nThis issue was identified by Michał Majchrowicz, Marcin Wyczechowski, and Paweł Zdunek, members of the AFINE Team.","summary":"IzPack's unpacker uses pack-file target paths without checking they stay inside the installation directory, so `../` sequences are honored. An attacker who repackages an IzPack installer can make the victim's run write files to arbitrary locations under the victim's privileges.","severity":"high","cvss":7.4,"epss":0.00452,"exploited":false,"exploited_at":null,"products":[{"name":"org.codehaus.izpack:izpack-installer","fixed":["5.2.7"],"affected":"< 5.2.7","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-22","installers","izpack","java","linux","macos","package","windows"],"not_affected_if":["izpack-installer-5.2.7-or-later","no-izpack-installers-distributed"],"how_to_check":"- Check the version of `org.codehaus.izpack:izpack-installer` in your build files or dependency tree (for example `mvn dependency:tree | grep izpack`); affected versions are below `5.2.7`.\n- Find installers you build or distribute that use IzPack and confirm which izpack-installer version produced them.","fix":"- Upgrade `org.codehaus.izpack:izpack-installer` to `5.2.7` and rebuild the installers.\n- Distribute rebuilt installers only from trusted channels and verify checksums of installers you received from others.","status":"open","published_at":"2026-08-26T14:24:40+00:00","first_seen_at":"2026-10-27T15:08:21+00:00","triaged_at":"2026-10-27T15:08:29+00:00","updated_at":"2026-10-27T15:08:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T15:08:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.codehaus.izpack:izpack-installer` to `5.2.7` and rebuild the installers.\n- Distribute rebuilt installers only from trusted channels and verify checksums of installers you received from others.","reach":"local","title":"IzPack installer: malicious pack entries write files outside the install directory","impact":"high","summary":"IzPack's unpacker uses pack-file target paths without checking they stay inside the installation directory, so `../` sequences are honored. An attacker who repackages an IzPack installer can make the victim's run write files to arbitrary locations under the victim's privileges.","category":"package","nicknames":[],"who_cares":["java","izpack","installers","windows","linux","macos"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker writes arbitrary files on victim machine, such as startup folders or system paths.","analyst_note":"","how_to_check":"- Check the version of `org.codehaus.izpack:izpack-installer` in your build files or dependency tree (for example `mvn dependency:tree | grep izpack`); affected versions are below `5.2.7`.\n- Find installers you build or distribute that use IzPack and confirm which izpack-installer version produced them.","needs_analyst":false,"not_affected_if":["izpack-installer-5.2.7-or-later","no-izpack-installers-distributed"],"who_is_affected":"Teams that build or ship installers with IzPack below 5.2.7 are exposed, since the flaw sits in the installer's unpacking code and runs on whichever machine executes the installer. Users who run such installers, especially as administrators on Windows, are the ones whose files could be written outside the install path. Teams that do not use IzPack to produce installers can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000806,"input_tokens":4874,"output_tokens":637,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A '-22':35B '-54550':21A,29A '/../../../tmp/escaped_file':378C '/iohelper.java':213C '/izpack/izpack.git':323C '/src/main/java/com/izforge/izpack/installer/unpacker/unpackerbase.java':167C,290C '/tmp/escaped_file':436C '/tmp/izpack_install':374C '1':304C,317C '2':329C '2025':283C '5.2.4':170C,320C '615':326C '618':171C '627':172C '650p':327C '88cj':25A 'administr':482C 'affect':451C 'allow':8A 'appdata':489C 'appli':511C 'arbitrari':80B 'arg':369C 'attack':65B,108C,140C,183C,253C,453C,485C 'attacker-chosen':139C 'attacker-control':182C 'authent':518C 'bash':303C,427C 'branch':318C 'call':231C 'canon':100C,199C 'canonical-path':99C 'carri':248C 'charact':219C 'check':53B,106C,200C,238C 'chosen':141C 'class':346C 'classpath':339C 'clone':305C,315C 'code':175C,312C 'com.izforge.izpack.installer.unpacker.unpackerbase.unpack':161C 'common':462C 'compil':330C 'confirm':276C 'contain':105C,125C,223C,237C 'control':184C 'convers':220C 'cve':19A,27A 'cwe':34B 'depth':316C 'destin':360C 'destination.replace':362C 'detail':158C 'digit':250C 'dir':407C 'direct':313C 'directori':14A,59B,104C,154C 'directory-contain':103C 'disk':144C 'distribut':110C,457C 'engin':465C 'entri':18A,122C,262C 'exact':348C 'except':371C 'f63g':24A 'fals':439C 'fetch':280C 'file':10A,49B,78B,94C,134C,163C,193C,196C,203C,217C,264C,388C,391C,414C,424C,433C 'file-separ':216C 'file.separatorchar':221C,363C 'filewrit':398C,401C 'fix':299C 'folder':152C 'follow':334C 'format':116C,265C 'fw':399C 'fw.write':403C 'generat':448C 'getcanonicalpath':233C,293C,426C 'ghsa':23A 'ghsa-f63g-88cj-hjf9':22A 'git':284C,314C 'github':282C 'github.com':322C 'github.com/izpack/izpack.git':321C 'grep':291C 'head':279C,286C 'hjf9':26A 'honor':63B 'impact':440C 'import':343C 'includ':120C,150C 'insid':56B,419C,437C 'instal':13A,36B,58B,70B,113C,132C,166C,246C,258C,289C,295C,406C,449C,460C,478C 'installdir':236C,373C,377C,420C,425C,438C 'installer':33A 'integr':274C 'iohelper.translatepath':187C,208C,351C 'izpack':1A,32A,37B,43B,69B,88C,165C,211C,245C,288C,306C,319C,338C,409C,447C,471C 'izpack-gener':446C 'izpack-instal':164C,287C 'izpack-installer':31A 'izpack-util':210C 'izpack/izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/unpackerbase.java':328C 'jar':114C,247C 'java':38B,178C,335C,341C,430C 'java.io':344C 'javac':428C 'legitim':257C 'line':169C 'linux':39B 'linux/macos':508C 'local':481C 'locat':81B,142C,157C,501C,516C 'maco':40B 'main':367C 'make':72B 'malici':16A,260C 'maliciouspath':376C,387C 'menu':493C 'method':160C 'microsoft':490C 'mkdir':201C,396C 'n':292C,325C,412C 'need':340C,455C 'new':195C,390C,400C,423C 'normalis':241C 'org.codehaus.izpack':30A 'output':298C,432C 'outsid':11A,405C 'pack':17A,48B,93C,121C 'pack-fil':47B,92C 'packag':41B 'packfil':261C 'packfile.gettargetpath':181C 'path':3A,51B,96C,101C,153C,176C,186C,197C,385C,392C,410C 'perform':214C 'platform':472C 'poc':302C 'present':301C 'primari':470C 'privileg':86B,149C 'program':494C 'protect':275C 'public':345C,364C 'reachabl':502C 'relev':174C 'repack':255C 'repackag':67B,459C 'replic':349C 'reproduc':336C 'resolv':91C,393C 'resourc':272C 'return':361C 'run':76B,130C,332C,444C,476C 'secur':225C,355C 'sed':324C 'segment':243C 'separ':190C,218C,352C 'sequenc':61B,126C 'serialis':271C 'show':285C 'signatur':251C 'social':464C 'social-engin':463C 'sourc':162C,209C,307C 'standard':268C 'start':492C 'startswith':235C,294C,422C 'startup':151C,495C 'static':356C,365C 'stay':55B 'string':179C,185C,357C,359C,368C,372C,375C,384C 'summari':87C 'swap':191C,353C 'system':156C 'system.out.println':413C,418C 'system32':497C 'systemroot':496C 'target':50B,95C,194C,207C,389C,402C 'target.getcanonicalpath':417C,421C 'target.getparentfile':395C 'targetpath':124C,180C,188C 'testpathtravers':347C,431C 'testpathtraversal.java':342C,429C 'throw':370C 'translatepath':358C,386C 'travers':4A,296C,394C,411C 'tri':397C 'trojan':112C 'typic':475C 'unpack':45B 'unpackerbas':6A,382C 'unpackerbase.unpack':90C 'unpatch':277C 'unsign':118C 'use':46B 'user':442C,506C,514C 'user-writ':513C 'util':212C 'valid':226C 'variabl':189C 'vector':466C 'via':15A,408C 'victim':74B,84B,129C,147C,474C,505C 'view':309C 'void':366C 'vulner':159C,168C,311C 'whatsoev':227C 'whose':123C 'window':42B,468C,491C 'without':52B,97C 'writabl':515C 'write':9A,77B,487C 'written':136C,205C,404C,415C,434C 'zip':269C","nicknames":[],"mitigations":[],"who_affected":"Teams that build or ship installers with IzPack below 5.2.7 are exposed, since the flaw sits in the installer's unpacking code and runs on whichever machine executes the installer. Users who run such installers, especially as administrators on Windows, are the ones whose files could be written outside the install path. Teams that do not use IzPack to produce installers can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-26T14:24:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f63g-88cj-hjf9","url":"https://github.com/advisories/GHSA-f63g-88cj-hjf9","severity":"high","published_at":"2026-08-26T14:24:40+00:00","modified_at":"2026-10-27T15:06:12+00:00","first_seen_at":"2026-10-27T15:08:21+00:00","fetched_at":"2026-10-27T15:13:25+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-54550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54550","severity":null,"published_at":"2026-08-26T15:16:49+00:00","modified_at":"2026-09-09T21:09:13+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}