EUVD-2026-72281
GHSA-vjp4-m83c-mp26
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Direct impact is arbitrary file write (I:H); confidentiality loss requires secondary exploitation steps, so C:N is more precise than the vendor's C:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
7Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Relative path traversal in Apache Ant's built-in ftp and scp tasks (versions 1.2 through 1.10.17) permits a malicious or MITM-intercepted remote server to supply server-controlled paths that escape the configured download directory, overwriting arbitrary files with the filesystem permissions of the Ant process. For FTP tasks not using FTPS, no server identity check is enforced, making a network MITM attacker sufficient to trigger the write primitive without needing a valid certificate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of two distinct scenarios depending on the Ant task configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately captures the network-reachable but complexity-gated nature of this flaw: AC:H reflects the mandatory MITM or malicious-server precondition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Ant 1.10.18 or later; this version restricts both `ftp` and `scp` download tasks from writing outside the destination directory by default, with an opt-out available for existing build files that legitimately depend on the old behavior. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit systems running Apache Ant versions 1.2-1.10.17 and identify CI/CD jobs using FTP or SCP download tasks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system propert
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large am
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that fi
Same weakness CWE-23 – Relative Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today