The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks. For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files. Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files. Mitigations: Use
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-78254 is a path traversal vulnerability affecting Apache Ant versions prior to 1.10.18, where the ftp and scp download tasks fail to properly validate relative paths provided by remote servers. This allows an attacker controlling a malicious server—or positioned to perform a man-in-the-middle attack—to write files outside the intended target directory using the privileges of the user running Ant. Organizations using Ant for build automation, deployment pipelines, or infrastructure provisioning are at risk of arbitrary file overwrite attacks that could compromise system integrity, inject malicious code into builds, or escalate privileges depending on file permissions and placement.
While this CVE currently has zero matching Casky skills, practitioners should monitor for exploitation patterns associated with CWE-23 (Relative Path Traversal). Casky's Claude AI-powered analysis would help detect anomalous file write operations during build processes, unexpected file modifications outside designated directories, and suspicious network communications with remote repositories during Ant execution. Security teams should focus on build pipeline monitoring for path traversal indicators, validate remote server certificates to prevent MITM attacks, and upgrade Ant to version 1.10.18 or later. Casky's extended reasoning capability can correlate build logs, network traffic, and file system changes to identify exploitation attempts that traditional static detection might miss.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-78254. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation