Aller au contenu
en Se connecter
Non notée

CVE-2026-50203 A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or…

Description

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Airflow SFTP provider 5.8 premières → < 5.8.1 5.8.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Airflow SFTP provider

Les 3 CVE de Apache Airflow SFTP provider →
CVE-2026-94135 The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable… Non notée CVE-2026-94134 The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or… Non notée
Suivre cette CVE