The PackagerResolver in Apache Ivy downloads and repackages artifacts using an Ant script stored in a subdirectory under a configured buildRoot directory. The subdirectory path is derived from module coordinates such as organisation, name, or version. If these coordinates include '../' sequences, which are valid in Ivy coordinates, it is possible to traverse directories outside the buildRoot, potentially overwriting files outside the intended directory. Exploitation requires the attacker to have the ability to add or modify coordinates in ivy.xml files within a packager repository. Versions 2.0.0 through 2.5.3 are affected, with a fix available in version 2.6.0.

An attacker with access to a packager repository can exploit this vulnerability to perform path traversal, allowing overwriting of arbitrary files outside the designated buildRoot directory. This could lead to unauthorized modification of files on the system where Apache Ivy is running, potentially impacting system integrity or availability depending on the files overwritten.

Users should upgrade Apache Ivy to version 2.6.0 or later, where this path traversal vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, restrict access to packager repositories to trusted users to prevent malicious coordinate manipulation.