https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:30:04 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-54550 <p>IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim&#39;s privileges when the victim runs the installer.</p> <p>IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim&#39;s privileges when the victim runs the installer.</p> https://db.gcve.eu/vuln/fkie_cve-2026-54550 https://db.gcve.eu/vuln/ghsa-f63g-88cj-hjf9 <p><strong>Affected:</strong> Maven: org.codehaus.izpack:izpack-installer</p> <p>### Summary</p> <p>IzPack&#39;s `UnpackerBase.unpack()` resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR (the format is unsigned) can include pack entries whose `targetPath` contains `../` sequences. When a victim runs the installer the file is written to an attacker-chosen location on disk under the victim&#39;s privileges — including startup folders, PATH directories, or system locations.</p> <p>### Details</p> <p>**Vulnerable method:** `com.izforge.izpack.installer.unpacker.UnpackerBase.unpack()` **Source file:** `izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java` **Vulnerable lines (5.2.4):** ~618–627</p> <p>The relevant code path is:</p> <p>```java String targetPath = packFile.getTargetPath(); // attacker-controlled String path = IoHelper.translatePath(targetPath, variables); // separator swap ONLY File target = new File(path); // no canonical check // ... mkdirs() then file is written to `target` ```</p> <p>`IoHelper.translatePath()` (source: `izpack-util/.../IoHelper.java`) performs **only** file-separator character conversion (`&#39;/&#39;` ↔ `File.separatorChar`) and contains no security validation whatsoever. There is no call to `getCanonicalPath()`, no `startsWith(installDir)` containment check, and no normalisation of `..` segments.</p> <p>Because IzPack installer JARs carry **no digital signature**, an attacker can repack any legitimate insta…</p> <p><strong>Affected:</strong> Maven: org.codehaus.izpack:izpack-installer</p> <p>### Summary</p> <p>IzPack&#39;s `UnpackerBase.unpack()` resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR (the format is unsigned) can include pack entries whose `targetPath` contains `../` sequences. When a victim runs the installer the file is written to an attacker-chosen location on disk under the victim&#39;s privileges — including startup folders, PATH directories, or system locations.</p> <p>### Details</p> <p>**Vulnerable method:** `com.izforge.izpack.installer.unpacker.UnpackerBase.unpack()` **Source file:** `izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java` **Vulnerable lines (5.2.4):** ~618–627</p> <p>The relevant code path is:</p> <p>```java String targetPath = packFile.getTargetPath(); // attacker-controlled String path = IoHelper.translatePath(targetPath, variables); // separator swap ONLY File target = new File(path); // no canonical check // ... mkdirs() then file is written to `target` ```</p> <p>`IoHelper.translatePath()` (source: `izpack-util/.../IoHelper.java`) performs **only** file-separator character conversion (`&#39;/&#39;` ↔ `File.separatorChar`) and contains no security validation whatsoever. There is no call to `getCanonicalPath()`, no `startsWith(installDir)` containment check, and no normalisation of `..` segments.</p> <p>Because IzPack installer JARs carry **no digital signature**, an attacker can repack any legitimate insta…</p> https://db.gcve.eu/vuln/ghsa-f63g-88cj-hjf9