CVE-2026-49297

{
  "id": "CVE-2026-49297",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T11:16:30.207",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains `..` segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP `destination_path` for `GCSToSFTPOperator`; the worker-local temp directory for `GCSTimeSpanFileTransformOperator`), enabling overwrite of arbitrary files on the SFTP server or the worker host. Affects deployments that ingest from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` 22.2.1 or later."
    },
    {
      "lang": "es",
      "value": "Los operadores del proveedor de Google de Apache Airflow ’GCSToSFTPOperator’ y ’GCSTimeSpanFileTransformOperator’ unieron los nombres de objetos de GCS devueltos por la API de listado de buckets directamente a una ruta del sistema de archivos de destino sin normalización ni verificación de contención. Un usuario con acceso de escritura al bucket GCS de origen (típicamente un principal de confianza diferente al autor del DAG - cargas de socios, cuentas de servicio de solo ingesta, buckets de datos públicos) podría crear un objeto cuyo nombre contenga segmentos ’..’ y hacer que la ejecución del DAG escriba el blob descargado fuera del destino configurado (la ’destination_path’ SFTP para ’GCSToSFTPOperator’; el directorio temporal local del trabajador para ’GCSTimeSpanFileTransformOperator’), permitiendo la sobrescritura de archivos arbitrarios en el servidor SFTP o en el host del trabajador. Afecta a las implementaciones que ingieren desde buckets escribibles por principales menos confiables. Se aconseja a los usuarios actualizar a ’apache-airflow-providers-google’ 22.2.1 o posterior."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow Google provider",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.python.org",
          "packageName": "apache-airflow-providers-google",
          "versions": [
            {
              "version": "0",
              "lessThan": "22.2.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T19:25:48.763029Z",
          "id": "CVE-2026-49297",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:apache-airflow-providers-google:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "22.2.1",
              "matchCriteriaId": "6CAFC50E-13FD-4AFB-8556-D9EE695D5A18"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/67667",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread/[email protected]",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/04/8",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}