Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Ivy

4 known vulnerabilities.

Apache Ivy at a glance

Last 12 months
1
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.4
    CVE-2026-26032

    Apache Ivy: PackagerResolver path traversal vulnerability

    The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. T…

    Apache Software Foundation Apache Ivy ivy Ubuntu
  • High 8.2
    CVE-2022-46751

    Apache Ivy: XML External Entity vulnerability in Apache Ivy

    Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML file…

    Apache Software Foundation Apache Ivy org.apache.ivy:ivy Maven
  • High 7.5
    CVE-2022-37866

    Apache Ivy allows path traversal in the presence of a malicious repository

    When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../…

    Apache Software Foundation Apache Ivy org.apache.ivy:ivy Maven
  • Critical 9.1
    CVE-2022-37865

    Apache Ivy allows creating/overwriting any file on the system

    With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the targ…

    Apache Software Foundation Apache Ivy org.apache.ivy:ivy Maven