The ftp and scp tasks in Apache Ant allow a download from a remote server to specify relative paths that escape the intended destination directory. Before version 1.10.18 this enabled an attacker to overwrite any file that the Ant process could write, giving the attacker the same permissions as the user executing the build. This type of path traversal flaw is catalogued as CWE‑23 and can lead to a complete compromise of the filesystem where Ant is running.

Apache Software Foundation Ant products prior to version 1.10.18 are affected. Executing ftp or scp tasks in these older releases makes a local file overwrite possible whenever the build script downloads from an untrusted or compromised source.

With a CVSS score of 7.4, this vulnerability is considered high severity. The EPSS score is < 1%, and it is not listed in CISA's KEV catalog, indicating a low to moderate public exploitation probability but still a serious risk. Exploiting the flaw requires a malicious or MITM‑controlled server. For plain FTP, a MITM can inject malicious paths; for FTPS or SCP the server must pass the identity checks performed by the task. If those preconditions are met and the task is run without additional safeguards, the attacker can overwrite arbitrary files as the Ant user.