CVE-2026-78254: CWE-23 Relative path traversal in Apache Software Foundation Apache Ant

Apache Ant's ftp and scp tasks download files from remote servers. Prior to version 1.10.18, these tasks do not properly restrict file paths, allowing a malicious server to provide relative paths that cause files to be written outside the designated target directory. This path traversal vulnerability (CWE-23) enables overwriting arbitrary files using the permissions of the Ant process user. Exploitation requires a malicious or man-in-the-middle server; for scp and ftps, server identity checks must be passed. Starting with Ant 1.10.18, the tasks prevent writing outside the destination directory by default, mitigating this vulnerability. Users can disable this protection if needed for legacy build files.

Successful exploitation allows an attacker controlling or intercepting the remote server connection to overwrite arbitrary files on the victim system with the permissions of the user running Apache Ant. This can lead to compromise of system integrity and potentially escalate to further attacks. The vulnerability does not affect availability but has high confidentiality and integrity impact. The CVSS v3.1 score is 7.4 (High).

Upgrade to Apache Ant version 1.10.18 or later, which includes an official fix preventing path traversal outside the destination directory by default. Users should ensure that server identity checks are not bypassed when using scp and ftp with ftps. For ftp without ftps, switching to ftps is recommended to prevent man-in-the-middle attacks. If legacy behavior is required, the new protection can be disabled, but this is not recommended.