Ant path traversal, Perl auth flaws, MapServer fixes

Several CVE disclosures and one security release shaped the day in open source security tooling and libraries. The reports cover path traversal, authentication replay and bypass issues, plus multiple fixes in geospatial server software.

Apache Ant path traversal in ftp and scp tasks

A path traversal issue tracked as CVE-2026-78254 was disclosed for Apache Ant. The flaw in the ftp and scp tasks permits arbitrary file writes outside the intended target directory. Build and deployment scripts that rely on these remote transfer tasks should treat the disclosure as a prompt to update and constrain write paths.

Replay flaw in Authen::SASL Perl DIGEST-MD5

CVE-2026-86219 affects Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100. The module accepts replayed authentication responses because server_step does not verify the nonce. Perl services using this DIGEST-MD5 SASL path remain exposed to replay until the package is upgraded past the vulnerable range.

MapServer 8.6.6 security release

MapServer issued version 8.6.6 as a security release that resolves six vulnerabilities. The fixes cover issues in WMS, WCS, CGI/FastCGI, and FlatGeobuf handling. Operators running MapServer should apply the release to close the reported attack surface in those components.

SAML bypass in MojoX::Authentication

CVE-2026-86304 was reported against MojoX::Authentication versions before 0.006 for Perl. The parse_assertion path constructs Net::SAML2::Binding::POST without a trust anchor, allowing SAML authentication bypass. Applications that depend on this module for SAML login need the 0.006 update to restore proper assertion validation.