https://seclists.org/oss-sec/2026/q3/660: CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
Published Sep 6, 2026
·Updated
Affected Software
1 affected component
Apache Apache Ant<1.10.18
Prioritize Apache Ant versions from 1.2 through versions before 1.10.18 where ftp or scp tasks download files from remote servers. The potential overwrite occurs with the permissions of the user running Ant.
The attacker must control the remote server or be able to perform a machine-in-the-middle attack. For scp and ftp using FTPS, the attacker must also pass the server identity checks performed by the task; non-FTPS ftp is susceptible to a machine-in-the-middle supplying malicious files.
Check whether build files use Ant ftp or scp download tasks, identify the Ant version in use, and determine whether the remote endpoint could be malicious or intercepted. Builds using Ant versions before 1.10.18 should also be checked for downloads that may receive relative paths from the server.
Starting with Ant 1.10.18, ftp and scp prevent writes outside the configured destination directory by default. An option exists to disable that protection if an existing build file requires the old behavior.