CVE-2026-49297

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-google versions prior to 22.2.1

Description The GCSToSFTPOperator and GCSTimeSpanFileTransformOperator operators in the Google provider join GCS object names from the bucket listing API to a destination filesystem path without normalization or containment checks. An attacker with write access to the source GCS bucket can create objects containing .. segments, leading to a path traversal. This allows the DAG run to write downloaded blobs outside the intended destination, specifically the destination path for GCSToSFTPOperator or the worker-local temp directory for GCSTimeSpanFileTransformOperator, potentially overwriting arbitrary files on the SFTP server or the worker host.

Recommendations Upgrade to apache-airflow-providers-google 22.2.1 or later.