Skip to content
Sign in
Not rated

CVE-2026-50203 A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or…

Description

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

Affected products and versions

Product Affected versions Fixed in
Apache Airflow SFTP provider 5.8 earliest → < 5.8.1 5.8.1

Other CVEs of Apache Airflow SFTP provider

The 3 CVEs of Apache Airflow SFTP provider →
CVE-2026-94135 The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable… Not rated CVE-2026-94134 The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or… Not rated
Track this CVE