{
  "cveId": "CVE-2026-26032",
  "url": "https://patchblox.com/security/cve/CVE-2026-26032",
  "summary": "CVE-2026-26032 is fixed in 3 products on 1 platform, first by SUSE-SU-2026:22858-1, released July 22, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "apache-commons-compress: This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue\n\nSecurity issues...",
  "description": "This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue\n\nSecurity issues fixed:\n\n- CVE-2026-26032: improper pathname limitation in \u0060PackagerResolver\u0060 allows for arbitrary files writes outside of the\n  configured \u0060buildRoot\u0060 directory (bsc#1271727).\n\nOther updates and bugfixes:\n\n- Update \u0060apache-commons-compress\u0060 to 1.28.0.\n- Update \u0060apache-ivy\u0060 to 2.6.0.\n- Include \u0060brotli-java\u0060 and update to 1.2.0.\n- Include \u0060zstd-jni\u0060 and update to v1.5.7.11.",
  "published": "2026-07-22T17:48:55Z",
  "severity": "moderate",
  "epss": 0.00507,
  "epssPercentile": 0.43534,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apache-commons-compress",
      "release": "sles 15.7",
      "fixedVersion": "1.28.0-150200.3.19.1",
      "fix": "SUSE-SU-2026:3225-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3225-1",
      "released": "2026-07-23T18:36:40Z"
    },
    {
      "platform": "linux",
      "product": "apache-ivy",
      "release": "Fedora 43",
      "fixedVersion": "2.6.0-2.fc43",
      "fix": "FEDORA-2026-D0535BED52",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d0535bed52",
      "released": "2026-08-21T13:40:54Z"
    },
    {
      "platform": "linux",
      "product": "apache-ivy",
      "release": "amzn 2023",
      "fixedVersion": "2.5.1-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-3207",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3207",
      "released": "2026-11-07T01:06:24Z"
    },
    {
      "platform": "linux",
      "product": "apache-ivy",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.6.0-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21424-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21424-1",
      "released": "2026-07-22T17:53:18Z"
    },
    {
      "platform": "linux",
      "product": "apache-ivy",
      "release": "sles 15.7",
      "fixedVersion": "2.6.0-150200.3.12.1",
      "fix": "SUSE-SU-2026:3225-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3225-1",
      "released": "2026-07-23T18:36:40Z"
    },
    {
      "platform": "linux",
      "product": "apache-ivy",
      "release": "sles 16.0",
      "fixedVersion": "2.6.0-160000.1.1",
      "fix": "SUSE-SU-2026:22858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22858-1",
      "released": "2026-07-22T17:48:55Z"
    },
    {
      "platform": "linux",
      "product": "apache-ivy-javadoc",
      "release": "Fedora 43",
      "fixedVersion": "2.6.0-2.fc43",
      "fix": "FEDORA-2026-D0535BED52",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-d0535bed52",
      "released": "2026-08-21T13:40:54Z"
    },
    {
      "platform": "linux",
      "product": "apache-ivy-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "2.5.1-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-3207",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3207",
      "released": "2026-11-07T01:06:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}