CVE-2026-78254: CWE-23 Relative path traversal in Apache Software Foundation Apache Ant

The ftp and scp tasks in Apache Ant versions >=1.2 and <1.10.18 allow a malicious remote server to supply relative paths that cause files to be written outside the designated target directory during downloads. This relative path traversal vulnerability (CWE-23) can lead to arbitrary file overwrite using the permissions of the user running Ant. Exploitation requires either a malicious server or a man-in-the-middle attack. For scp and ftp with ftps, the server must pass identity checks, reducing risk. For ftp without ftps, a man-in-the-middle can provide malicious files more easily. Starting with Apache Ant 1.10.18, the tasks prevent writing outside the destination directory by default, with an option to disable this behavior for backward compatibility. Users are recommended to upgrade to 1.10.18 and not bypass server identity checks.

Successful exploitation allows an attacker controlling or intercepting the remote server to overwrite arbitrary files on the local system with the privileges of the user running Apache Ant. This can lead to compromise of system integrity and potentially escalate to further attacks depending on the overwritten files. The vulnerability does not affect availability but impacts confidentiality and integrity.

Upgrade Apache Ant to version 1.10.18 or later, which includes an official fix preventing writing outside the destination directory by default. Users of scp and ftp tasks with ftps should ensure server identity checks are not bypassed. Users of ftp without ftps are advised to switch to ftps where possible to reduce risk of man-in-the-middle attacks. Avoid disabling the new default protection unless absolutely necessary for legacy build files.