The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files. Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: Primavera Unifier

oracle CPUOct2026: MySQL Server >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4677-1 advisory.

    This update introduces new libraries and refines existing Java tools to     improve security, compatibility, stability, and formatting.

    ant (Updated to version 1.10.18):

    - Security issues fixed:

      - CVE-2021-36374: Fixed excessive memory allocation when reading specially crafted ZIP archives or     derived formats         (bsc#1188469)
      - CVE-2025-7962: Fixed improper neutralization of line breaks to prevent SMTP injection (bsc#1246873)
      - CVE-2026-78254: Fixed path traversal in FTP and SCP tasks that could allow arbitrary file writes     (bsc#1280015)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789382807 advisory.

  - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can     provide relative paths that allow it to write outside of the dedicated target directory for the download,     making it possible to overwrite files of the attacker's choice using the permissions of the user running     Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have     to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the     ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks     not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.
    Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default.
    An option is available to disable this behavior in the unlikely case that the old behavior is required by     existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not     bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users     are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue. (CVE-2026-78254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789746085 advisory.

  - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can     provide relative paths that allow it to write outside of the dedicated target directory for the download,     making it possible to overwrite files of the attacker's choice using the permissions of the user running     Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have     to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the     ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks     not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.
    Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default.
    An option is available to disable this behavior in the unlikely case that the old behavior is required by     existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not     bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users     are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue. (CVE-2026-78254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789746085 advisory.

  - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can     provide relative paths that allow it to write outside of the dedicated target directory for the download,     making it possible to overwrite files of the attacker's choice using the permissions of the user running     Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have     to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the     ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks     not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.
    Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default.
    An option is available to disable this behavior in the unlikely case that the old behavior is required by     existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not     bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users     are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue. (CVE-2026-78254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21891-1 advisory.

    - CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived     formats       (bsc#1188469).
    - CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection       (bsc#1246873).
    - CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).

    Changes for ant:

    - Upgrade to version 1.10.18
     * Breaking changes:
     + the default value for <ftp>'s useSecureDataChannel has been      changed to true which means using ftps now also tries to use      an encrypted data channel by default.
     + the <ftp> and <scp> tasks have new allowFilesToEscapeDest      attributes. When set to false - which is the default - the      tasks will not download files or create directories outside      the designated destination directory when downloading from the      remote server. In the unlikely case you need the old bahaviour      of writing outside the destination directory you must set the      value to true explicitly.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can     provide relative paths that allow it to write outside of the dedicated target directory for the download,     making it possible to overwrite files of the attacker's choice using the permissions of the user running     Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have     to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the     ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks     not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.
    Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default.
    An option is available to disable this behavior in the unlikely case that the old behavior is required by     existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not     bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users     are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue. (CVE-2026-78254)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366400	SUSE SLED15: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (SUSE-SU-2026:4677-1)	Nessus	SuSE Local Security Checks	Local	medium
362151	AlmaLinux 9.2 [TuxCare] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / ant-apache-oro / etc (ALMALINUX9.2:CLSA-2026:1789382807)	Nessus	Alma Linux Local Security Checks	Local	high
353088	AlmaLinux 9.6 [TuxCare] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / ant-apache-oro / etc (ALMALINUX9.6:CLSA-2026:1789746085)	Nessus	Alma Linux Local Security Checks	Local	high
352444	Rocky Linux 9.6 [TuxCare] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / ant-apache-oro / etc (ALMALINUX9.6:CLSA-2026:1789746085)	Nessus	Rocky Linux Local Security Checks	Local	high
350151	openSUSE 16: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (openSUSE-SU-2026:21891-1)	Nessus	SuSE Local Security Checks	Local	medium
343526	Linux Distros Unpatched Vulnerability : CVE-2026-78254	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-78254

high

Tenable Plugins

Coming Soon

medium

high

high

high

medium

high