Source: ant X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for ant. CVE-2026-78254[0]: | The ftp and scp tasks of Apache Ant can download files from a remote | server. A malicious server can provide relative paths that allow it | to write outside of the dedicated target directory for the download, | making it possible to overwrite files of the attacker's choice using | the permissions of the user running Ant in versions prior to Ant | 1.10.18. In order to exploit this vulnerability, the server | would either have to be malicious or be subject to a machine-in-the- | middle attack. Additionally in the case of scp or the ftp task using | ftps the server must pass the server identity checks performed by | the tasks. For ftp tasks not using ftps a malicious server could | act as a machine-in-the-middle to provide malicious files. | Starting with Ant 1.10.18 both tasks will prevent writing outside of | the destination directory by default. An option is available to | disable this behavior in the unlikely case that the old behavior is | required by existing build files. Mitigations: Users of scp | and ftp (when using ftps) in any version of Ant should not bypass | server identity checks. Users of ftp not using ftps should switch to | ftps where possible. All users are recommended to upgrade to | Apache Ant 1.10.18, which fixes this issue. https://www.openwall.com/lists/oss-security/2026/09/06/2 https://github.com/apache/ant/commit/07ee9c418e3bd3e7d0287fc9aaba3011e88f0dc2 (ANT_1.10.18_RC1) https://github.com/apache/ant/commit/9252566cab812c59a5695679ba11f497e85aabb0 (ANT_1.10.18_RC1) https://github.com/apache/ant/commit/3807d672ea18d9f8dafd5eb9b2fe1de05f664539 (ANT_1.10.18_RC1) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-78254 https://www.cve.org/CVERecord?id=CVE-2026-78254 Please adjust the affected versions in the BTS as needed.
