https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-06T18:30:04.136779+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-54550 fkie_cve-2026-54550 2026-10-06T18:30:04.140451+00:00

IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim's privileges when the victim runs the installer.

 https://db.gcve.eu/vuln/ghsa-f63g-88cj-hjf9 GHSA-f63g-88cj-hjf9 — IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pa… 2026-10-06T18:30:04.140562+00:00

Affected: Maven: org.codehaus.izpack:izpack-installer

### Summary

IzPack's `UnpackerBase.unpack()` resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR (the format is unsigned) can include pack entries whose `targetPath` contains `../` sequences. When a victim runs the installer the file is written to an attacker-chosen location on disk under the victim's privileges — including startup folders, PATH directories, or system locations.

### Details

**Vulnerable method:** `com.izforge.izpack.installer.unpacker.UnpackerBase.unpack()` **Source file:** `izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java` **Vulnerable lines (5.2.4):** ~618–627

The relevant code path is:

```java String targetPath = packFile.getTargetPath(); // attacker-controlled String path = IoHelper.translatePath(targetPath, variables); // separator swap ONLY File target = new File(path); // no canonical check // ... mkdirs() then file is written to `target` ```

`IoHelper.translatePath()` (source: `izpack-util/.../IoHelper.java`) performs **only** file-separator character conversion (`'/'` ↔ `File.separatorChar`) and contains no security validation whatsoever. There is no call to `getCanonicalPath()`, no `startsWith(installDir)` containment check, and no normalisation of `..` segments.

Because IzPack installer JARs carry **no digital signature**, an attacker can repack any legitimate insta…