- Description
- A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.
- Source
- security@apache.org
- NVD status
- Analyzed
- Products
- apache-airflow-providers-sftp
CVSS 3.1
- Type
- Secondary
- Base score
- 9.1
- Impact score
- 5.2
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity
- CRITICAL
- security@apache.org
- CWE-22
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:apache-airflow-providers-sftp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFF26BE9-7893-46C4-9285-6D3B9C9BF48D",
"versionEndExcluding": "5.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]