The PackagerResolver module in Apache Ivy allows an attacker to download artifacts and repack them via an Ant script stored under a subdirectory of the configured buildRoot. Because the subdirectory name is derived from module coordinates such as organisation, name, and version, an attacker who injects a coordinate containing the string "../" can cause the path calculation to escape the intended buildRoot and overwrite any file within that directory. This flaw is a classic path‑traversal vulnerability and can replace legitimate files with malicious ones if write rights are granted.

Apache Software Foundation’s Ivy product, versions 2.0.0 through 2.5.3, is affected. The issue is confined to the PackagerResolver module across this version range.

The CVSS base score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to gain write access to a packager repository and modify an ivy.xml file to include coordinates containing "../" sequences. Hence the attack vector is restricted, but the potential impact of file overwrite remains significant if write privileges are granted.