CVE-2026-49297— Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)
Quick assessment
Affected
Apache Software Foundation Apache Airflow Google provider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache camel是美国Apache基金会开源的一个企业集成模式框架。 Apache Camel 22.2.1之前版本存在路径遍历漏洞，该漏洞源于GCS对象名称未经规范化或包含性检查直接拼接到目标文件系统路径，可能导致有源GCS存储桶写入权限的用户通过创建包含“..”段的对象名，使DAG运行将下载的blob写入配置目标之外的位置，从而覆盖SFTP服务器或工作节点上的任意文件。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow Google provider | < 22.2.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49297
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)
Source: CVE Program / CVE List V5
Vulnerability Description
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains `..` segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP `destination_path` for `GCSToSFTPOperator`; the worker-local temp directory for `GCSTimeSpanFileTransformOperator`), enabling overwrite of arbitrary files on the SFTP server or the worker host. Affects deployments that ingest from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` 22.2.1 or later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Camel 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache camel是美国Apache基金会开源的一个企业集成模式框架。 Apache Camel 22.2.1之前版本存在路径遍历漏洞，该漏洞源于GCS对象名称未经规范化或包含性检查直接拼接到目标文件系统路径，可能导致有源GCS存储桶写入权限的用户通过创建包含“..”段的对象名，使DAG运行将下载的blob写入配置目标之外的位置，从而覆盖SFTP服务器或工作节点上的任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow Google provider | 0 ~ 22.2.1 | - |
|
II. Public POCs for CVE-2026-49297
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49297
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-49297 (1)
Mailing List Discussions for CVE-2026-49297 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-06 · 39 CVEs total
| CVE-2026-46457 | Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange withou | |
| CVE-2026-48205 | Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed nam | |
| CVE-2026-48204 | Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed n | |
| CVE-2026-48203 | Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non- | |
| CVE-2026-46726 | Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket quer | |
| CVE-2026-46592 | Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed name | |
| CVE-2026-46591 | Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header a | |
| CVE-2026-46590 | Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle manager | |
| CVE-2026-46585 | Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETUR | |
| CVE-2026-46584 | Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail | |
| CVE-2026-48206 | Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP h | |
| CVE-2026-46456 | Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange with | |
| CVE-2026-46455 | Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the | |
| CVE-2026-46454 | Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange wi | |
| CVE-2026-46453 | Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel | |
| CVE-2026-43865 | Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed H | |
| CVE-2026-42527 | Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables | |
| CVE-2026-40859 | Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a | |
| CVE-2026-40047 | Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argum | |
| CVE-2026-56139 | Apache Camel Undertow: The muteException consumer option defaulted to false, so a processi |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Airflow Google provider
-
CVE-2026-68868
Apache Airflow Google provider: google Secret Manager backen -
CVE-2026-45361
Apache Airflow Google provider: SSH host key verification di -
CVE-2023-25692
Apache Airflow Google Provider: Google Cloud Sql Provider De -
CVE-2023-25691
Apache Airflow Google Provider: Google Cloud Sql Provider Re
Same vendor: Apache Software Foundation
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-63046
Apache InLong: Agent Installer — Command Injection to RCE vi -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer
Same weakness: CWE-22
-
CVE-2026-66897
Instance template path traversal allows arbitrary host file -
CVE-2026-78196
achorein expo-share-intent Android File Copy Routine ExpoSha -
CVE-2026-10053
Improper Limitation of a Pathname to a Restricted Directory -
CVE-2026-18027
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery -
CVE-2026-76606
Joomla Extension - fabrikar.com - Path Traversal via image e
V. Comments for CVE-2026-49297
No comments yet