CVE-2026-49818
Description
The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.
How to fix
- apache apache-airflow-providers-samba4.12.6 or later
- apache-airflow-providers-samba4.12.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache apache-airflow-providers-samba | v < 4.12.6 | 4.12.6 |
| apache-airflow-providers-sambaPyPI | v < 4.12.6 | 4.12.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.