EUVD-2026-35374
GHSA-f6vj-48fm-hmvx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (CNA) · only source for this CVE.
CVSS VectorVendor
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Path traversal in Apache Airflow's Samba provider exposes Samba target file systems to arbitrary write operations when GCSToSambaOperator processes GCS object names containing directory traversal sequences. Disclosed on 2026-06-09 via the oss-security mailing list by Apache committer Jarek Potiuk as a pre-NVD disclosure, the vulnerability enables any party who can influence GCS object names in the source bucket to write files outside the intended destination directory on the Samba share. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control or influence the name of objects stored in the GCS bucket that serves as the source for a GCSToSambaOperator invocation - either through direct GCS bucket write access or by poisoning an upstream data pipeline stage that deposits objects into the bucket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector or score is available for this pre-NVD disclosure, making any quantitative risk comparison impossible at this stage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with write access to the source GCS bucket - or with the ability to influence upstream pipeline stages that populate bucket objects - uploads a file with a crafted name such as `../../airflow/dags/backdoor.py`. When a scheduled or triggered Airflow DAG executes GCSToSambaOperator, the operator builds the destination path without sanitizing the object name, writing the file to the traversed location on the Samba share. … |
| Remediation | No vendor-released patch has been confirmed at time of analysis - this is a pre-NVD, pre-advisory disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Airflow deployments using GCSToSambaOperator and audit GCS bucket permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today