Maven/org.codehaus.izpack:izpack-installer CVE-2026-54550: high 7.4, EPSS 0.45%
IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
Action: Upgrade org.codehaus.izpack:izpack-installer to 5.2.7 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.2.7 | - |
Fixed versions
| 5.2.7 |
Sources
- osv: GHSA-f63g-88cj-hjf9
- https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9
- https://github.com/izpack/izpack/pull/1193
- https://github.com/izpack/izpack/commit/4233ba38d0f1825f9cf3e0204e5261a5498e29d8
- https://github.com/izpack/izpack/commit/8b7c6792c4fe85e3b1759c106aae39b904848466
- https://github.com/izpack/izpack
- https://nvd.nist.gov/vuln/detail/CVE-2026-54550
- https://github.com/izpack/izpack/releases/tag/izpack-5.2.7
CVE-2026-54550 · published · modified · JSON