CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
Apache Ant 1.2 before 1.10.18 ftp and scp tasks allow path traversal, letting malicious servers overwrite arbitrary files (CVE-2026-78254).
CVE-2026-78254 affects Apache Ant (org.apache.ant:ant) versions 1.2 before 1.10.18 and is rated moderate. The ftp and scp tasks download files from a remote server, and a malicious server can supply relative paths that write outside the dedicated target directory, overwriting attacker-chosen files with the permissions of the user running Ant. The issue is fixed in Apache Ant 1.10.18.
- Path traversal in ftp/scp tasks enables arbitrary file write
- Attacker needs to control the remote server Ant downloads from
- Fixed in Apache Ant 1.10.18
- Rated moderate by the Apache Ant team
- CVEs
- CVE-2026-78254
- Products
- Apache Ant
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78254 | Path Traversal in Apache Ant ftp and scp Tasks Allows Arbitrary File Write | 7.4 | <1% |
From the original article
Posted by Stefan Bodewig on Sep 06 Severity: moderate Affected versions: - Apache Ant (org. apache. ant:ant) 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.