CVE-2026-78254
Received Received - Intake

Path Traversal in Apache Ant

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: Apache Software Foundation

Description
The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files. Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-78254
EUVD
EUVD-2026-72281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache ant to 1.10.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Ant affects the ftp and scp tasks which download files from remote servers. A malicious server can send relative paths that allow writing outside the intended download directory, potentially overwriting files with the permissions of the user running Ant. This requires the server to be malicious or a machine-in-the-middle attack to succeed.

Detection Guidance

Detecting this vulnerability requires checking the version of Apache Ant installed on your system. Run the command 'ant -version' to verify if you are using a version prior to 1.10.18. Additionally, inspect build files using ftp or scp tasks to ensure they do not bypass server identity checks or use unencrypted ftp.

Impact Analysis

An attacker could overwrite critical files on your system, such as configuration files or executables, by exploiting this vulnerability. This could lead to system compromise, data loss, or unauthorized access depending on the files targeted and the permissions of the user running Ant.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized file overwrites on systems handling sensitive data. If exploited, it may lead to data integrity breaches or unauthorized access, which are key concerns under these regulations.

Mitigation Strategies

Upgrade Apache Ant to version 1.10.18 or later immediately. If upgrading is not possible, ensure server identity checks are not bypassed for scp and ftp (ftps) tasks. Switch to ftps for ftp tasks if currently using unencrypted ftp.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart