CVE-2026-50203Critical· 9.1▾ MidnightApache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.6%
Last analysed / modified upstream
0.6% → 0.9%
A path traversal in the SFTP provider (SFTPHook.retrieve_directory / SFTPOperator(operation=get)) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade apache-airflow-providers-sftp to 5.8.1 or later.
apache-airflow-providers-sftp < 5.8.1Upgrade to a patched release:
apache-airflow-providers-sftp 5.8.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94135Medium· 4.3The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false
CVE-2024-1728High· 8.1Gradio allows users to access arbitrary files
CVE-2024-11042Critical· 9.1InvokeAI Arbitrary File Deletion vulnerability
CVE-2022-31573Critical· 9.3ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function
CVE-2024-10902Critical· 9.1DB-GPT vulnerable to Arbitrary File Upload with Path Traversal
CVE-2024-10833Critical· 9.1DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload