35
CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
Apache Ant 1.2 before 1.10.18 ftp and scp tasks allow path traversal, letting malicious servers overwrite arbitrary files (CVE-2026-78254).
CVE-2026-78254 affects Apache Ant (org.apache.ant:ant) versions 1.2 before 1.10.18 and is rated moderate. The ftp and scp tasks download files from a remote server, and a malicious server can supply relative paths that write outside the dedicated target directory, overwriting attacker-chosen files with the permissions of the user running Ant. The issue is fixed in Apache Ant 1.10.18.
40
USN-8514-2: OpenSSH vulnerability
Ubuntu backports an OpenSSH fix to older LTS releases for an scp flaw enabling setuid file placement and privilege escalation.
USN-8514-2 extends the USN-8514-1 OpenSSH fix to Ubuntu 14.04 LTS, 18.04 LTS, and 20.04 LTS. The flaw stems from incorrect file permission handling when downloading files as root using the legacy scp protocol without the preserve-mode option. An attacker could exploit this to install setuid or setgid files on the system, potentially leading to privilege escalation.
35
30
35
30
30
30
30
30
30
30
30