IzPack’s UnpackerBase accepts a targetPath supplied by an installer pack entry and passes it through a path translation routine that only converts separators, without normalizing parent-directory segments or restricting the destination. A crafted entry containing "../" sequences therefore allows an attacker to write files outside the intended installation directory to locations such as startup folders, executable search paths, or other writable directories that are reachable with the victim’s privileges. The result is that malicious code can be placed and later executed in the context of the user running the installer, enabling arbitrary code execution.

The vulnerability is present in IzPack 5.2.6 and all earlier releases. The affected product is the IzPack Installer, a Java‑based packaging tool for creating cross‑platform installers. Any system that deploys or runs applications using an installer built with IzPack 5.2.6 or earlier is susceptible to this flaw.

The CVSS score of 7.4 indicates a high potential for local code execution. EPSS data is not available, so no current exploitation probability can be quantified. The flaw is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a malicious installer; this can occur via social engineering, supply‑chain compromise, or procurement of unsigned installers. The likely attack vector is local and does not depend on network exposure; the attacker must supply a malicious installer, and the embedded code runs with the privileges of the user executing the installer, potentially allowing further system‑wide compromise.