https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T03:54:56.652492+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-50203 CVE-2026-50203 — Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destina… 2026-10-03T03:54:56.665812+00:00

Affected: Apache Software Foundation Apache Airflow SFTP provider

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.