The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files. Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.

tuxcare ALMALINUX9.6:CLSA-2026:1789746085: ant: Fix of CVE-2026-78254 (Moderate)

tuxcare ALMALINUX9.2:CLSA-2026:1789382807: ant: Fix of CVE-2026-78254 (Moderate)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21891-1 advisory.

    - CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived     formats       (bsc#1188469).
    - CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection       (bsc#1246873).
    - CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).

    Changes for ant:

    - Upgrade to version 1.10.18
     * Breaking changes:
     + the default value for <ftp>'s useSecureDataChannel has been      changed to true which means using ftps now also tries to use      an encrypted data channel by default.
     + the <ftp> and <scp> tasks have new allowFilesToEscapeDest      attributes. When set to false - which is the default - the      tasks will not download files or create directories outside      the designated destination directory when downloading from the      remote server. In the unlikely case you need the old bahaviour      of writing outside the destination directory you must set the      value to true explicitly.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can     provide relative paths that allow it to write outside of the dedicated target directory for the download,     making it possible to overwrite files of the attacker's choice using the permissions of the user running     Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have     to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the     ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks     not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.
    Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default.
    An option is available to disable this behavior in the unlikely case that the old behavior is required by     existing build files. Mitigations: Users of scp and ftp (when using ftps) in any version of Ant should not     bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible. All users     are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue. (CVE-2026-78254)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350151	openSUSE 16: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (openSUSE-SU-2026:21891-1)	Nessus	SuSE Local Security Checks	Local	medium
343526	Linux Distros Unpatched Vulnerability : CVE-2026-78254	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-78254

high

Tenable Plugins

Coming Soon

medium

high