CVE-2026-78254: Apache Ant Path Traversal Vulnerability

CVE-2026-78254 Overview

Apache Ant contains a path traversal vulnerability in its ftp and scp tasks that download files from remote servers. A malicious or compromised server can supply relative paths containing directory traversal sequences, causing Ant to write files outside of the designated target directory. Successful exploitation allows an attacker to overwrite arbitrary files using the privileges of the user running Ant. The flaw affects all versions prior to Apache Ant 1.10.18 and is tracked under CWE-23: Relative Path Traversal.

Critical Impact
A malicious remote server or machine-in-the-middle attacker can overwrite arbitrary files on build systems running Apache Ant, potentially leading to code execution during subsequent builds.

Affected Products

Apache Ant versions prior to 1.10.18 using the ftp task
Apache Ant versions prior to 1.10.18 using the scp task
Build environments and CI/CD pipelines depending on vulnerable Ant releases

Discovery Timeline

2026-09-07 - CVE-2026-78254 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78254

Vulnerability Analysis

The ftp and scp tasks in Apache Ant retrieve files from a remote server and write them to a local destination directory. Before version 1.10.18, neither task validated that the filenames returned by the server resolved within that destination directory. When the server supplied a filename containing ../ sequences or an absolute path, Ant honored the path and wrote the file to the resulting location on disk.

Exploitation lets an attacker overwrite files with the permissions of the user running the Ant build. On CI/CD workers, this often includes build scripts, configuration files, or artifacts that are executed later in the pipeline, enabling downstream code execution.

Starting in Ant 1.10.18, both tasks reject writes outside the destination directory by default. An opt-in flag restores the legacy behavior for build files that depend on it.

Root Cause

The root cause is missing path canonicalization and containment checks on server-supplied filenames. Ant trusted the remote server to provide well-formed relative paths, so no check ensured the resolved output path remained inside the configured target directory. This matches the CWE-23 pattern where a relative path from an untrusted source is used directly in a filesystem write.

Attack Vector

Exploitation requires the attacker to control the file listing served to the Ant client. Two scenarios apply:

Malicious server: A build configured to fetch files from an attacker-controlled ftp or scp endpoint receives crafted filenames that traverse out of the target directory.
Machine-in-the-middle (MITM): For ftp without ftps, an on-path attacker can rewrite server responses to inject traversal sequences. For scp and ftps, MITM exploitation additionally requires bypassing or disabling server identity verification.

Because the write occurs with the privileges of the Ant process, overwriting a file that is later executed by the build user provides a straightforward path to code execution.

// No verified public proof-of-concept is available for CVE-2026-78254.
// See the Apache advisory for technical details:
// https://lists.apache.org/thread/05s46qrlbhd06c6rsgvxh8zo0l4p9scz

Detection Methods for CVE-2026-78254

Indicators of Compromise

Files written by the Ant build user outside the declared todir destination of ftp or scp tasks.
Unexpected modification of shell profiles, SSH authorized_keys, cron entries, or build scripts on hosts that run Ant.
Ant build logs referencing downloaded filenames containing .., absolute paths, or unusual directory separators.

Detection Strategies

Inventory build definitions for use of the ftp and scp Ant tasks and identify the Ant version in use on each build agent.
Review network egress from build hosts to confirm that ftp and scp destinations are trusted and terminated with certificate validation.
Alert on file writes by the Ant process to paths outside expected workspace directories using endpoint telemetry.

Monitoring Recommendations

Monitor CI/CD workers for file integrity changes to system directories, user home directories, and build tool binaries.
Log and review outbound ftp, ftps, and ssh sessions initiated by build processes.
Track Apache Ant versions across the fleet and flag any host still running a release prior to 1.10.18.

How to Mitigate CVE-2026-78254

Immediate Actions Required

Upgrade all Apache Ant installations to version 1.10.18 or later.
Audit build scripts for ftp and scp tasks and confirm the remote endpoints are trusted and authenticated.
Do not disable server identity checks on scp or ftps tasks, even temporarily during troubleshooting.
Where feasible, replace plain ftp usage with ftps to prevent machine-in-the-middle rewriting of file listings.

Patch Information

Apache Ant 1.10.18 fixes the vulnerability by preventing writes outside the destination directory in both the ftp and scp tasks by default. A configuration option preserves the pre-patch behavior for build files that explicitly require it. Full details are available in the Apache Ant Security Advisory and the corresponding Openwall OSS-Security post.

Workarounds

Restrict Ant ftp and scp tasks to internal, authenticated servers under organizational control.
Run Ant builds under least-privilege accounts that cannot overwrite system binaries, SSH configuration, or other build tooling.
Isolate build agents on network segments that block outbound traffic to untrusted ftp and ssh endpoints.

bash

# Verify the installed Apache Ant version is 1.10.18 or later
ant -version

# Example: enforce strict host key checking for scp-based Ant tasks
# in the build user's SSH configuration
cat >> ~/.ssh/config <<'EOF'
Host *
    StrictHostKeyChecking yes
    UserKnownHostsFile ~/.ssh/known_hosts
EOF