30
30
CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
Apache Ant 1.2 before 1.10.18 ftp and scp tasks allow path traversal, letting malicious servers overwrite arbitrary files (CVE-2026-78254).
CVE-2026-78254 affects Apache Ant (org.apache.ant:ant) versions 1.2 before 1.10.18 and is rated moderate. The ftp and scp tasks download files from a remote server, and a malicious server can supply relative paths that write outside the dedicated target directory, overwriting attacker-chosen files with the permissions of the user running Ant. The issue is fixed in Apache Ant 1.10.18.
40
30
30
30
30
35
30
30
30
30
30
30
35
35
30
30
30
30
35
35
35
30
35
35
30
30
30
30
30
30
30
30
30
30
30
30
30
30