airflow-toolkit (0.13.3), airflow-tools (>=0.5.0, <=0.12.0) potentially affected by CVE-2026-50203 via apache-airflow-providers-sftp (4.11.1)

apache-airflow-providers-sftp PYPI version 4.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-sftp and may be impacted: - airflow-toolkit 0.13.3 - airflow-tools =0.5.0, =0.12.0 Source cves: CVE-2026-50203 Source advisory:...

airflow-toolkit (0.13.3), airflow-tools (>=0.5.0, <=0.12.0) potentially affected by CVE-2026-50203 via apache-airflow-providers-sftp (4.11.1)

apache-airflow-providers-sftp PYPI version 4.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-sftp and may be impacted: - airflow-toolkit 0.13.3 - airflow-tools =0.5.0, =0.12.0 Source cves: CVE-2026-50203 Source advisory:...

CVE-2026-50203

A path traversal in the SFTP provider "SFTPHook.retrievedirectory" / "SFTPOperatoroperation=get" let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface ...

airflow-toolkit (0.13.3), airflow-tools (>=0.5.0, <=0.12.0) potentially affected by CVE-2026-50203 via apache-airflow-providers-sftp (4.11.1)

apache-airflow-providers-sftp PYPI version 4.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-sftp and may be impacted: - airflow-toolkit 0.13.3 - airflow-tools =0.5.0, =0.12.0 Source cves: CVE-2026-50203 Source advisory:...

CVE-2026-50203: Improper Limitation of a Pathname to a Restricted Directory

A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...