PUBLISHED
2026-06-09 09:16
MODIFIED
2026-06-09 09:16
EPSS (Prob. Exploit)
0.97%
Top 38.4%
> DESCRIPTION
The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-22: Improper Limitation of a Pathname to a Restricted Directory - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
> GITHUB SECURITY ADVISORY
GHSA-f6vj-48fm-hmvx
MODERATE
Apache Airflow has a Path Traversal issue
AFFECTED PACKAGES:
PIP / apache-airflow-providers-samba
< 4.12.6
Fixed in: 4.12.6
> HISTORIQUE DES MODIFICATIONS
Première apparition
09/06/2026 09:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - The product uses external input to construct a pathname that is intended to identify a file or directory that i...
Nouvelle valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneat...
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - The product uses external input to construct a pathname that is intended to identify a file or directory that i...
Total des modifications: 2
Dernière mise à jour: 6 days ago