{"id":"CVE-2026-49818","aliases":["GHSA-f6vj-48fm-hmvx","PYSEC-2026-208"],"title":"Apache Airflow has a Path Traversal issue","summary":"Apache Airflow has a Path Traversal issue","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","vendor":"apache-airflow-providers-samba","product":"apache-airflow-providers-samba","ecosystem":"pip","affected":["apache-airflow-providers-samba < 4.12.6"],"patched":["apache-airflow-providers-samba 4.12.6"],"published":"2026-06-09","updated":"2026-07-31","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-f6vj-48fm-hmvx","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49818"},{"url":"https://github.com/apache/airflow/pull/67857"},{"url":"https://github.com/apache/airflow/commit/bc1df029af15cb1d35d5ca0d33bf9235500137cc"},{"url":"https://github.com/apache/airflow"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-samba/PYSEC-2026-208.yaml"},{"url":"https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf"},{"url":"http://www.openwall.com/lists/oss-security/2026/06/09/8"}],"tags":["osv","pip"],"epss":0.0097,"epssPercentile":0.60244,"ingestedAt":"2026-07-31T19:10:06.991Z","slug":"CVE-2026-49818","body":"## Overview\n\nThe Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.\n\n## Affected packages\n\n- `apache-airflow-providers-samba < 4.12.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apache-airflow-providers-samba 4.12.6`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}