CVE-2026-50203

A path traversal vulnerability exists in the SFTP provider of apache-airflow-providers-sftp (specifically within SFTPHook.retrieve_directory and SFTPOperator(operation=get)). A malicious or compromised remote SFTP server can use crafted directory-entry names to write files outside the configured ...