점검 대응높음KEV 미등록
CVE-2026-49297
Apache Software Foundation Apache Airflow Google provider, apache-airflow-providers-google 취약점
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains `..` segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP `destination_path`...
- 대응 우선순위
- 점검
- CVSS
- 8.1
- EPSS
- 0.70% 백분위 49.5% · 2026.08.02 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.06