The ftp and scp tasks in Apache Ant versions prior to 1.10.18 can be exploited via relative path traversal by a malicious or man-in-the-middle server to write files outside the designated target directory. This allows overwriting arbitrary files with the privileges of the user running Ant. The vulnerability requires the server to pass identity checks for scp and ftps tasks; for ftp without ftps, a man-in-the-middle can provide malicious files. Apache Ant 1.10.18 fixes this by enforcing directory write restrictions by default, with an option to disable this behavior if needed.

An attacker controlling or intercepting the remote server can overwrite arbitrary files on the local system where Apache Ant runs, using the permissions of the Ant user. This could lead to unauthorized file modification or code execution depending on the overwritten files and user privileges.

Users should upgrade to Apache Ant 1.10.18 or later, which includes a fix preventing writes outside the destination directory by default. Users of scp and ftp with ftps must not bypass server identity checks. For ftp without ftps, switching to ftps is recommended to prevent man-in-the-middle attacks. If upgrading is not immediately possible, ensure strict server identity verification and avoid unencrypted ftp where feasible.