org.codehaus.izpack vulnerabilities

Products

• org.codehaus.izpack/izpack-installer 1

Latest org.codehaus.izpack CVEs

Newest publication first

1. CVE-2026-54550 IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries

   Published 2026-08-26

   High·CVSS 7.4

   IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.