CVE-2026-78254

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18.

In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.

For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.

Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files.

Mitigations:

Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.

All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files. Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files. Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18.

In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.

For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.

Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files.

Mitigations:

Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.

All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

• CVE-2026-78254: path traversal in the ftp and scp tasks let a malicious server write downloaded files outside the destination directory
• Add FileUtils.getResolvedPath as a prerequisite for the CVE-2026-78254 fix, which uses it in the skipped-file log messages

• CVE-2026-78254: fix path traversal in ftp and scp tasks when retrieving remote files
• ant-manual: require ant-javadoc so the manual/api symlink target exists

These are all security issues fixed in the ant-1.10.18-2.1 package on the GA media of openSUSE Tumbleweed.

This update for ant fixes the following issues:

• CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived formats (bsc#1188469).
• CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection (bsc#1246873).
• CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).

Changes for ant:

• Upgrade to version 1.10.18

• Breaking changes:

• the default value for <ftp>'s useSecureDataChannel has been changed to true which means using ftps now also tries to use an encrypted data channel by default.
• the <ftp> and <scp> tasks have new allowFilesToEscapeDest attributes. When set to false - which is the default - the tasks will not download files or create directories outside the designated destination directory when downloading from the remote server. In the unlikely case you need the old bahaviour of writing outside the destination directory you must set the value to true explicitly.

• Other changes:

• when using the SOURCE_DATE_EPOCH environment variable to set the time for <tstamp> the timezone will now be set to UTC for DSTAMP, TSTAMP and TODAY. This also applies to nested formats where the locale now also defaults to en_US unless it (or the timezone) have been set explicitly.
• Upgraded the jakarta.mail dependency to 2.0.2 because of bsc#1246873, CVE-2025-7962.
• the SOURCE_DATE_EPOCH environment variable as well as the magic ant.tstamp.now and ant.tstamp.now.iso properties now also affect the timestamp added to a properties file written by <propertyfile> - but only if jdkproperties has its default value of false.
• a new method getBuildDate in Project can now be used to calculate a notion of a "build date" that consults the SOURCE_DATE_EPOCH environment variable as well as the magic ant.tstamp.now and ant.tstamp.now.iso properties in this order which you can use if you want to obtain a reproducible timestamp in tasks you write yourself.
• The "record" task now has a new "relativeToBaseDir" attribute, which can be set to "yes" or "no", to control where the recorder's file gets created. In the absence of this attribute, if the "name" of the recorder was a relative path, then the recorder would create the file in the current working directory of the process. With this new attribute, the recorder can be configured to create that file in the basedir of the project.

• Fixed bugs:

• When running with "microsoft" Java, Ant used to hardcode the "$JAVA_HOME/Packages" directory in the runtime Paths for certain tasks. The JDK shipped by Microsoft no longer contains that directory (for several decades now). As a result, when running with "microsoft" Java, an exception would be raised due to the missing directory. This has now been fixed and Ant no longer adds that directory to the Java runtime Paths.
• Inaccuracies in the documentation of the "record" task have been fixed.
• <mappedresources> with "enableMultipleMappings" set to "true" threw a NullPointerException if the mapper didn't apply to one of the resources. Unmapped resources are now omitted from the collection.

• Changes of version 1.10.17

• The JavaEnvUtils and FileUtils classes statically depend on each other since Ant 1.10.16 making it impossible to load JavaEnvUtils without loading FileUtils first causing NullPointerException for programmatic use on Windows. This affected Eclipse and may also affect other projects using Ant as a library. The classes can now be loaded independently again.

• Changes of version 1.10.16

• <xslt> now uses the same logic to compare file timestamps when determining whether a target file is out-of-date with respect to the source file or stylesheet that most other tasks use. This means it will assume a default timestamp granularity that depends on the current operating system. A new granularity attribute allows you to override the assumed granularity. …

This update for Java fixes the following issues:

This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting.

ant (Updated to version 1.10.18):

• Security issues fixed:

  • CVE-2021-36374: Fixed excessive memory allocation when reading specially crafted ZIP archives or derived formats (bsc#1188469)
  • CVE-2025-7962: Fixed improper neutralization of line breaks to prevent SMTP injection (bsc#1246873)
  • CVE-2026-78254: Fixed path traversal in FTP and SCP tasks that could allow arbitrary file writes (bsc#1280015)

• Other changes and bugs fixed:

  • Breaking changes:

    • FTPS tasks now use encrypted data channels by default.
    • FTP and SCP tasks now prevent files or directories from being written outside the target directory by default.

  • Other changes:

    • Added package ant-junit5 that allows tests to be launched and run using the JUnit 5 framework.
    • Improved support for reproducible builds by standardizing timestamps, file modification times, and timezone handling.
    • Upgraded the jakarta.mail dependency to version 2.0.2.
    • Added an option to the 'record' task to create log files relative to the project directory.

  • Bugs fixed:

    • Fixed compatibility and startup issues when running on newer Java versions.
    • Fixed network handling issues in FTP and SCP tasks, including proper support for IPv6 addresses.
    • Improved security in email tasks by verifying TLS server certificates and enforcing STARTTLS encryption.
    • Improved report generation performance in JUnit launcher tasks.
    • Fixed regressions and edge cases in resource mapping, path conversion, and command execution.

json-simple (Updated to version 2.3.1):

• Updated to a newer version that makes reading and writing structured web data (JSON) safer and more reliable.
• Added a 'pretty-printing' feature to format web data so it is easier to read.
• Made reading and writing data safer when multiple tasks are running simultaneously.
• Made looking up data more flexible, allowing the tool to automatically handle different format types (like numbers and text).

junit5 (Updated to version 5.14.4):

• Fixed an issue where tests could conflict or run incorrectly when executed at the same time.
• Corrected test behavior on newer versions of Java so they run reliably.
• Improved test reports so that test names are clearer, unique, and easier to distinguish from one another.
• Added features to customize how test names are generated and better capture testing outputs.

maven-doxia, maven-doxia-sitetools (Updated to version 2.1.0):

• Added support for displaying the last modification date and author on generated web pages.
• Added support for displaying interactive diagrams (such as flowcharts or charts) directly on web pages.
• Improved formatting and layout for modern documents, including better tables, lists, and links.

maven-surefire, maven-surefire-plugins (Updated to version 3.5.6):

• Fixed a bug that caused software testing tasks to fail abruptly with an unexpected error [bsc#1273185].
• Added timestamps to testing reports so you can see exactly when tests ran.
• Made running multiple tests at the same time much more reliable, preventing mixed-up report results.
• Added the ability to immediately stop testing once a failure is detected (saving time).

objectweb-asm (Updated to version 9.10.1):

• Added support for newer Java versions, including bytecode support up to Java 27.
• Prevented out-of-memory errors when processing invalid or corrupted class files.
• Improved bytecode analysis and verification to correctly handle valid Java code and prevent unexpected analysis errors
• Improved compliance with FIPS 140-3 security standards during class serialization.
• Corrected package import ranges to prevent dependency conflicts in OSGi environments.
• Fixed unexpected crashes and errors in code generation and inspection…