https://seclists.org/oss-sec/2026/q2/941: CVE-2026-50203: Apache Airflow SFTP provider: Path traversal in SFTPHook.trieve_dictory allows local file write outside the destination dictory via malicious server-supplied dictory-entry names
Published Jun 16, 2026
·Updated
Affected Software
1 affected component
pypi/apache-airflow-providers-sftp<5.8.1
Frequently Asked Questions
1
What is the severity of CVE-2026-50203?
The severity of CVE-2026-50203 is classified as moderate.
2
How do I fix CVE-2026-50203?
To fix CVE-2026-50203, update the Apache Airflow SFTP provider to version 5.8.1 or later.
3
What versions are affected by CVE-2026-50203?
CVE-2026-50203 affects the Apache Airflow SFTP provider versions prior to 5.8.1.
4
What kind of vulnerability is CVE-2026-50203?
CVE-2026-50203 is a path traversal vulnerability that allows local file write outside the destination directory.
5
Which component is impacted by CVE-2026-50203?
CVE-2026-50203 impacts the SFTPHook.retrieve_directory and SFTPOperator operations within the Apache Airflow SFTP provider.