---
id: CVE-2026-49818
aliases:
  - GHSA-f6vj-48fm-hmvx
  - PYSEC-2026-208
title: Apache Airflow has a Path Traversal issue
summary: Apache Airflow has a Path Traversal issue
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
vendor: apache-airflow-providers-samba
product: apache-airflow-providers-samba
ecosystem: pip
affected:
  - apache-airflow-providers-samba < 4.12.6
patched:
  - apache-airflow-providers-samba 4.12.6
published: '2026-06-09'
updated: '2026-07-31'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-f6vj-48fm-hmvx'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49818'
  - url: 'https://github.com/apache/airflow/pull/67857'
  - url: >-
      https://github.com/apache/airflow/commit/bc1df029af15cb1d35d5ca0d33bf9235500137cc
  - url: 'https://github.com/apache/airflow'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-samba/PYSEC-2026-208.yaml
  - url: 'https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/09/8'
tags:
  - osv
  - pip
epss: 0.0097
epssPercentile: 0.60244
ingestedAt: '2026-07-31T19:10:06.991Z'
---

## Overview

The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.

## Affected packages

- `apache-airflow-providers-samba < 4.12.6`

## Remediation

Upgrade to a patched release:

- `apache-airflow-providers-samba 4.12.6`