CVE-2026-26032: 
NixOS vulnerability analysis and mitigation

CVE-2026-26032 is a path traversal vulnerability in the PackagerResolver component of Apache Ivy, classified as moderate severity. It affects Apache Ivy versions 2.0.0 through 2.5.3 (inclusive) and was publicly disclosed on July 15, 2026. The flaw allows an attacker with access to a packager repository to write files outside the configured buildRoot directory by embedding ../ sequences in module coordinates within ivy.xml files. It carries a CVSS v3.1 base score of 5.4 (Medium) (Apache Advisory, GitHub Advisory). The vulnerability was reported by yudeshui of dhgate security (Openwall OSS-Sec).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). Apache Ivy's PackagerResolver downloads online artifacts and repackages them using an Ant script stored in a subdirectory of the configured buildRoot directory. This subdirectory path is constructed from module coordinates such as organisation, name, and version fields in ivy.xml. Because Ivy does not sanitize ../ sequences from these coordinate values — which are otherwise valid in Ivy's coordinate system — a malicious ivy.xml can cause the Ant script to be written to an arbitrary location outside buildRoot, enabling overwrite of arbitrary files on the filesystem (Openwall OSS-Sec, GitHub Advisory).

Successful exploitation allows an attacker to overwrite arbitrary files on the system running Apache Ivy, potentially leading to code execution if critical files (e.g., scripts, configuration files, or binaries) are replaced. The confidentiality impact is low (limited file read exposure), while the integrity impact is low-to-moderate due to arbitrary file write capability. Availability is not directly impacted, but file overwrite could destabilize the affected system or enable privilege escalation and lateral movement (GitHub Advisory, Feedly).

1. Gain repository access: Obtain write access to a packager repository that is consumed by a target Apache Ivy 2.0.0–2.5.3 installation using the PackagerResolver feature.
2. Craft malicious ivy.xml: Create or modify an ivy.xml file in the repository, embedding ../ sequences in one or more module coordinates (e.g., organisation, name, or version fields), such as version="../../etc/cron.d/malicious".
3. Trigger artifact resolution: Wait for or cause the target Ivy build system to resolve the malicious module via the PackagerResolver, which downloads the artifact and constructs the Ant script path using the tainted coordinates.
4. Achieve file overwrite: The Ant script is written to the attacker-controlled path outside buildRoot, overwriting a target file (e.g., a cron job, startup script, or configuration file).
5. Achieve code execution: If a writable executable or script file was overwritten with attacker-controlled content, wait for or trigger its execution to achieve arbitrary code execution on the host (Openwall OSS-Sec, GitHub Advisory).

• File System: Unexpected files or scripts appearing outside the configured buildRoot directory, particularly in sensitive locations such as /etc/cron.d/, init script directories, or application configuration paths; modification timestamps on system files coinciding with Ivy build activity.
• Logs: Ivy or Ant build logs showing module coordinates containing ../ sequences; file write operations to paths outside the expected buildRoot in system audit logs (e.g., auditd records).
• Process: Ant processes spawning unexpected child processes or writing to unusual filesystem locations during artifact repackaging steps.

Users should upgrade Apache Ivy to version 2.6.0, which addresses the path traversal vulnerability by sanitizing module coordinates before constructing filesystem paths (Apache Advisory, Openwall OSS-Sec). As a compensating control, restrict write access to packager repositories to trusted users only, reducing the attacker's ability to introduce malicious ivy.xml files. Additionally, implement file integrity monitoring on the buildRoot directory and its parent directories to detect unauthorized file modifications.

The vulnerability was announced via the Apache mailing lists and the oss-security list on July 15, 2026, with a PGP-signed advisory from Apache Ivy committer Stefan Bodewig (Openwall OSS-Sec). Community discussion was noted on Bluesky shortly after disclosure. No significant vendor statements beyond the Apache advisory or notable researcher commentary have been identified at this time.