Review reviewCritical

CVE-2026-50203

Apache Software Foundation Apache Airflow SFTP provider, apache-airflow-providers-sftp

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

CVSS: 9.1
EPSS: 0.63%
CISA KEV: Not listed
Published: 2026.06.17

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.63%

Technical severityCVSS 9.1

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache Airflow SFTP provider, apache-airflow-providers-sftp
Affected versions: < 5.8.1
Fixed versions: 5.8.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache Airflow SFTP provider, apache-airflow-providers-sftp and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-22