CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write

CVE-2026-78254 is a path traversal flaw (CWE-23) in the ftp and scp download tasks of Apache Ant: in versions prior to 1.10.18, a server providing downloaded files can use relative paths to write outside the dedicated destination directory. It is triggered when an Ant build uses the ftp or scp task to fetch files from a malicious server, or via a machine-in-the-middle attack against plain ftp; for scp and ftps, the attacking server must still pass the tasks' server identity checks. A successful attack lets the attacker overwrite files of their choosing on the machine running the build, using the permissions of the user executing Ant, potentially tampering with scripts, libraries, or build outputs. Affected users are those running Apache Ant builds (before 1.10.18) that download files with the ftp or scp tasks, especially against servers that are not fully trusted or are reached over untrusted networks. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

Do: Upgrade to Apache Ant 1.10.18, which by default prevents these tasks from writing outside the destination directory. Do not bypass server identity checks for scp and ftps, and switch ftp tasks from plain ftp to ftps where possible to prevent machine-in-the-middle attacks. Audit build files for ftp/scp download usage and restrict them to trusted, verified servers until patched.