GitHub Advisoryadvisory · PyPI

GHSA-qf38-jq28-3ccq Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory

CRITICAL Published 2026-06-17 Modified 2026-07-09 Official page ↗
Aliases
CVE-2026-50203
Ecosystem
PyPI
Packages
apache-airflow-providers-sftp
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2026-06-18

Affected packages

• PyPI apache-airflow-providers-sftp: < 5.8.1 → fixed in 5.8.1

Description

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

Related

Alias · CVE (1)

  • CVE-2026-50203 A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References