CVE-2026-78254

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>apache-ant</name>
	<range><lt>1.10.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ftp and scp tasks of Apache Ant can download files from a remote
	server. A malicious server can provide relative paths that allow it to
	write outside of the dedicated target directory for the download,
	making it possible to overwrite files of the attacker's choice using
	the permissions of the user running Ant in versions prior to Ant
	1.10.18. 




In order to exploit this vulnerability, the server would
	either have to be malicious or be subject to a machine-in-the-middle
	attack. Additionally in the case of scp or the ftp task using ftps
	the server must pass the server identity checks performed by the
	tasks.




For ftp tasks not using ftps a malicious server could act
	as a machine-in-the-middle to provide malicious files.




Starting
	with Ant 1.10.18 both tasks will prevent writing outside of the
	destination directory by default. An option is available to disable
	this behavior in the unlikely case that the  old behavior is required
	by existing build files.




Mitigations:




Users of scp and ftp
	(when using ftps) in any version of Ant should not bypass server
	identity checks. Users of ftp not using ftps should switch to ftps
	where possible.




All users are recommended to upgrade to Apache Ant
	1.10.18, which fixes this issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-78254</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-78254</url>
    </references>
    <dates>
      <discovery>2026-09-07</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>