PT-2026-50220 · Apache · Apache Airflow Ftp Provider

Jarek Potiuk + 1 · Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2026-50203

Mitre

A path traversal in the SFTP provider (SFTPHook.retrieve directory / SFTPOperator(operation=get)) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade apache-airflow-providers-sftp to 5.8.1 or later.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-50203

Produtos afetados

Apache Airflow Ftp Provider

Referências · 3

• https://github.com/apache/airflow/pull/67985 · Correção
• http://openwall.com/lists/oss-security/2026/06/16/3 · Nota
• https://lists.apache.org/thread/7f4b284oh44c1n95oq8mh1qc7y1lr9dx · Aviso do Fabricante