Path traversal in Apache Ant - CVE-2026-78254

Vulnerability identifier: #VU147210

CSH Severity: Medium

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-78254

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to overwrite arbitrary files.

The vulnerability exists due to path traversal in the ftp and scp tasks when processing files downloaded from a malicious server. A remote attacker can provide relative paths to write files outside the dedicated download target directory.

For scp and FTPS, the server must pass the tasks' server identity checks; non-FTPS FTP connections may be subject to a machine-in-the-middle attack.

Apache Ant
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Development Tools Module
Basesystem Module
SUSE Package Hub 15
IBM Sterling Control Center
IBM SPSS Collaboration and Deployment Services
IBM Netezza Performance Server
plexus-build-api0
ant-contrib
opentest4j
plexus-i18n
plexus-build-api
zstd-jni
plexus-languages
plexus-interactivity-api
ant-antlr
ant-swing
ant-junit5
ant-apache-log4j
ant-manual
ant-apache-oro
ant-apache-xalan2
ant-jdepend
ant-apache-bsf
ant-apache-regexp
ant-junit
ant-commons-logging
ant
ant-scripts
ant-testutil
ant-jmf
ant-javamail
ant-apache-bcel
ant-jakartamail
ant-jsch
ant-commons-net
ant-xz
ant-apache-resolver
byte-buddy-javadoc
byte-buddy-maven-plugin
byte-buddy
byte-buddy-agent
plexus-interpolation
plexus-sec-dispatcher
qdox
plexus-cipher
maven-doxia-sitetools
maven-doxia-module-xhtml5
maven-doxia-module-xdoc
maven-doxia-core
maven-doxia-sink-api
maven-doxia-module-fml
maven-doxia-module-apt
jakarta-activation
jakarta-mail
plexus-component-metadata
plexus-containers-component-annotations
json-simple
plexus-velocity
bsf
antlr-java
antlr-manual
antlr-devel
antlr
univocity-parsers
jdepend
plexus-classworlds
plexus-compiler
plexus-xml
apache-commons-digester3
velocity-tools-generic
maven-surefire-plugin
maven-surefire
maven-surefire-provider-junit
maven-surefire-provider-testng
plexus-io
assertj-core
javaparser
javassist
plexus-utils
picocli
plexus-archiver
junit5-minimal
junit5
objectweb-asm
IBM Integrated Analytics System

Install security update from vendor's website.

Apache Ant - update to 1.10.18
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
plexus-build-api0 - update to 0.0.8-150200.5.8.7
ant-contrib - update to 1.0b3-150200.11.17.1
opentest4j - update to 1.2.0-150200.3.6.4
plexus-i18n - update to 1.2.0-150200.3.10.2
plexus-build-api - update to 1.2.0-150200.3.10.2
zstd-jni - update to 1.5.7.16-150200.5.7.2
plexus-languages - update to 1.6.0-150200.3.8.2
plexus-interactivity-api - update to 1.6.0-150200.3.10.2
ant-antlr - update to 1.10.18-150200.4.31.3
ant-swing - update to 1.10.18-150200.4.31.3
ant-junit5 - update to 1.10.18-150200.4.31.3
ant-apache-log4j - update to 1.10.18-150200.4.31.3
ant-manual - update to 1.10.18-150200.4.31.3
ant-apache-oro - update to 1.10.18-150200.4.31.3
ant-apache-xalan2 - update to 1.10.18-150200.4.31.3
ant-jdepend - update to 1.10.18-150200.4.31.3
ant-apache-bsf - update to 1.10.18-150200.4.31.3
ant-apache-regexp - update to 1.10.18-150200.4.31.3
ant-junit - update to 1.10.18-150200.4.31.3
ant-commons-logging - update to 1.10.18-150200.4.31.3
ant - update to 1.10.18-150200.4.31.3
ant-scripts - update to 1.10.18-150200.4.31.3
ant-testutil - update to 1.10.18-150200.4.31.3
ant-jmf - update to 1.10.18-150200.4.31.3
ant-javamail - update to 1.10.18-150200.4.31.3
ant-apache-bcel - update to 1.10.18-150200.4.31.3
ant-jakartamail - update to 1.10.18-150200.4.31.3
ant-jsch - update to 1.10.18-150200.4.31.3
ant-commons-net - update to 1.10.18-150200.4.31.3
ant-xz - update to 1.10.18-150200.4.31.3
ant-apache-resolver - update to 1.10.18-150200.4.31.3
byte-buddy-javadoc - update to 1.18.8-150200.5.13.2
byte-buddy-maven-plugin - update to 1.18.8-150200.5.13.2
byte-buddy - update to 1.18.8-150200.5.13.2
byte-buddy-agent - update to 1.18.8-150200.5.13.2
plexus-interpolation - update to 1.30.0-150200.3.12.4
plexus-sec-dispatcher - update to 2.0-150200.3.10.2
qdox - update to 2.0.1-150200.3.6.2
plexus-cipher - update to 2.1.0-150200.3.10.2
maven-doxia-sitetools - update to 2.1.0-150200.3.23.17
maven-doxia-module-xhtml5 - update to 2.1.0-150200.4.21.15
maven-doxia-module-xdoc - update to 2.1.0-150200.4.21.15
maven-doxia-core - update to 2.1.0-150200.4.21.15
maven-doxia-sink-api - update to 2.1.0-150200.4.21.15
maven-doxia-module-fml - update to 2.1.0-150200.4.21.15
maven-doxia-module-apt - update to 2.1.0-150200.4.21.15
jakarta-activation - update to 2.1.0-150200.5.7.1
jakarta-mail - update to 2.1.0-150200.5.7.2
plexus-component-metadata - update to 2.2.0-150200.3.12.2
plexus-containers-component-annotations - update to 2.2.0-150200.3.12.2
json-simple - update to 2.3.1-150200.5.3.5
plexus-velocity - update to 2.4.0-150200.3.13.2
bsf - update to 2.4.0-150200.13.8.2
antlr-java - update to 2.7.7-150200.18.10.2
antlr-manual - update to 2.7.7-150200.18.10.2
antlr-devel - update to 2.7.7-150200.18.10.2
antlr - update to 2.7.7-150200.18.10.2
univocity-parsers - update to 2.9.1-150200.3.9.4
jdepend - update to 2.10-150200.11.6.2
plexus-classworlds - update to 2.12.1-150200.3.8.2
plexus-compiler - update to 2.17.1-150200.3.12.2
plexus-xml - update to 3.1.0-150200.5.13.2
apache-commons-digester3 - update to 3.2-150200.5.3.5
velocity-tools-generic - update to 3.2-150200.5.3.10
maven-surefire-plugin - update to 3.5.6-150200.3.9.23.3
maven-surefire - update to 3.5.6-150200.3.9.23.28
maven-surefire-provider-junit - update to 3.5.6-150200.3.9.23.28
maven-surefire-provider-testng - update to 3.5.6-150200.3.9.23.28
plexus-io - update to 3.8.0-150200.3.10.2
assertj-core - update to 3.27.7-150200.5.11.8
javaparser - update to 3.28.2-150200.3.10.2
javassist - update to 3.29.2-150200.3.12.2
plexus-utils - update to 4.1.0-150200.3.17.2
picocli - update to 4.7.6-150200.3.19.2
plexus-archiver - update to 4.14.0-150200.3.13.2
junit5-minimal - update to 5.14.4-150200.3.15.10
junit5 - update to 5.14.4-150200.3.15.15
objectweb-asm - update to 9.10.1-150200.3.20.3
IBM Integrated Analytics System - update to 8.10.26.09.SP1
IBM Netezza Performance Server - update to 11.3.1.3 IF6

• https://lists.apache.org/api/email.lua?id=l1kmyhdknk0lzscxfozxncmcv8nptstk
• https://ant.apache.org/

• Path traversal in Apache Ant
• IBM Control Center update for Apache Ant
• IBM Netezza Performance Server update for Apache Ant
• IBM Integrated Analytics System update for Apache Ant
• SUSE update for the Java stack
• IBM SPSS Collaboration and Deployment Services update for Apache Ant