CVE-2026-78254

A flaw was found in Apache Ant. The ftp and scp tasks, used for downloading files, are vulnerable to a path traversal issue. A malicious remote server can exploit this by providing specially crafted relative paths, allowing it to write files outside the intended download directory. This could lead to an attacker overwriting arbitrary files on the system with the permissions of the user running Ant, potentially compromising the system's integrity.

This Moderate impact flaw in Apache Ant's ftp and scp tasks allows an attacker to write arbitrary files outside the intended download directory. This occurs when an Ant user connects to a malicious remote server or is subject to a machine-in-the-middle attack, enabling path traversal. Successful exploitation is limited to the privileges of the user executing Ant.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, users of Apache Ant's scp and ftp tasks should ensure that server identity checks are not bypassed. For ftp tasks not utilizing ftps, it is recommended to configure the tasks to use ftps to enhance security against machine-in-the-middle attacks.