CVE-2022-37865: Apache Ivy Archive Extraction Path Verification Vulnerability
Summary
CVE-2022-37865: Apache Ivy does not verify target path when extracting the archive. Affects org.apache.ivy:ivy versions >= 2.4.0, < 2.5.1. Fixed in 2.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ivy is a popular dependency management tool for Java projects. It is used to resolve and retrieve project dependencies from remote repositories. Ivy supports various packaging formats, including zip, jar, and war. These packages can be unpacked on the fly during the resolution process. However, prior to version 2.5.1, Ivy did not properly verify the target path when extracting the archive. This vulnerability allows an attacker to write files to any location on the local file system that the user executing Ivy has write access to.
Vulnerability Detail
The vulnerability in Apache Ivy arises from the lack of target path verification during archive extraction. When processing artifacts with zip, jar, or war packaging, Ivy does not adequately validate the target path. This oversight enables an attacker to include absolute paths or path traversal sequences like ".." in the archive, leading to arbitrary file write operations. An attacker with write access to the local file system can exploit this vulnerability to overwrite or create files in sensitive locations, potentially compromising the integrity and security of the system.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can exercise caution when processing artifacts with zip, jar, or war packaging. It is advisable to only work with trusted artifacts from known sources. Additionally, users can manually verify the contents of the archive and extract it to a secure location using a tool that performs proper path validation.
Conclusion
The Apache Ivy Archive Extraction Path Verification Vulnerability allows an attacker to write files to arbitrary locations on the local file system. This can lead to unauthorized modifications or creations of files, posing a significant risk to the system's integrity and security. Users are advised to upgrade to Apache Ivy version 2.5.1 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ivy:ivy →
FAQ
Apache Ivy is a dependency management tool for Java projects. It helps resolve and retrieve project dependencies from remote repositories.
This vulnerability allows an attacker to write files to any location on the local file system that the user executing Ivy has write access to. This can lead to unauthorized modification or creation of files, potentially compromising the system's integrity and security.
Versions 2.4.0 to 2.5.0 of Apache Ivy are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Apache Ivy version 2.5.1 or later.
As a temporary workaround, users can exercise caution when processing artifacts with zip, jar, or war packaging. It is advisable to only work with trusted artifacts from known sources.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ivy:ivy.
