https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 19:39:08 +0000 https://cve.radiocsirt.org/vuln/cve-2026-49818 <p><strong>Affected:</strong> Apache Software Foundation Apache Airflow Samba provider</p> <p>The Apache Airflow Samba provider&#39;s `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Airflow Samba provider</p> <p>The Apache Airflow Samba provider&#39;s `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.</p> https://cve.radiocsirt.org/vuln/cve-2026-49818 https://cve.radiocsirt.org/vuln/pysec-2026-208 <p><strong>Affected:</strong> PyPI: apache-airflow-providers-samba</p> <p>The Apache Airflow Samba provider&#39;s `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.</p> <p><strong>Affected:</strong> PyPI: apache-airflow-providers-samba</p> <p>The Apache Airflow Samba provider&#39;s `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.</p> https://cve.radiocsirt.org/vuln/pysec-2026-208