CVE-2026-49297 Details
Description
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains `..` segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP `destination_path` for `GCSToSFTPOperator`; the worker-local temp directory for `GCSTimeSpanFileTransformOperator`), enabling overwrite of arbitrary files on the SFTP server or the worker host. Affects deployments that ingest from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` 22.2.1 or later.
A path traversal vulnerability has been identified in Apache Airflow's Google provider, specifically within the GCSToSFTPOperator and GCSTimeSpanFileTransformOperator. These operators improperly handled Google Cloud Storage (GCS) object names by directly appending them to destination filesystem paths without adequate normalization or containment checks. This flaw allows a user with write access to the source GCS bucket—often a different trust principal than the DAG author, such as partner uploads, ingest-only service accounts, or public-data buckets—to create an object with a name containing '..' segments. Consequently, the DAG run could write the downloaded blob outside the designated destination, either overwriting arbitrary files on the SFTP server or the worker host. This vulnerability affects deployments that ingest from buckets writable by less-trusted principals.
Users are advised to upgrade to apache-airflow-providers-google version 22.2.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/04/8 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/67667 | [email protected] | ExploitIssue TrackingPatch |
| https://lists.apache.org/thread/[email protected] | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache apache-airflow-providers-google | < 22.2.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | CVE Modified | CVE |
| Jul 6, 2026 | New CVE Received | [email protected] |