# org.apache.ant:ant (Maven) vulnerabilities

5 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Dependents: 372
- Registry: https://central.sonatype.com/artifact/org.apache.ant/ant

## Advisories (5)

### [CVE-2026-78254](https://cve.now/CVE-2026-78254): Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write

- Severity: High 7.4
- Published: Sep 7, 2026
- Affected: from 1.2, fixed in 1.10.18.

### [CVE-2021-36374](https://cve.now/CVE-2021-36374): Apache Ant ZIP, and ZIP based, archive denial of service vulerability

- Severity: Unrated
- Published: Jul 14, 2021
- Affected: from 1.9.0, fixed in 1.9.16; from 1.10.0, fixed in 1.10.11.

### [CVE-2021-36373](https://cve.now/CVE-2021-36373): Apache Ant TAR archive denial of service vulnerability

- Severity: Unrated
- Published: Jul 14, 2021
- Affected: fixed in 1.9.16; from 1.10.0, fixed in 1.10.11.

### [CVE-2020-11979](https://cve.now/CVE-2020-11979): As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was al

- Severity: Unrated
- Published: Oct 1, 2020
- Affected: fixed in 1.10.9.

### [CVE-2020-1945](https://cve.now/CVE-2020-1945): Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir…

- Severity: Unrated
- Published: May 14, 2020
- Affected: from 1.1, fixed in 1.9.15; from 1.10.0, fixed in 1.10.8.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.ant:ant
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.