This vulnerability involves improper link resolution before file access (CWE-59) in Apache Airflow's FileTaskHandler. A DAG author can create symbolic links or use specially crafted task IDs containing '..' sequences that bypass the configured base_log_folder restrictions. This allows the API server process to read or overwrite arbitrary files outside the intended log directory, but only in deployments where the worker log folder is shared with the API server. The vulnerability enables both read-path and write-path attacks, potentially exposing sensitive files like /etc/passwd or airflow.cfg or allowing unauthorized file modifications.

The impact includes unauthorized disclosure of sensitive files and potential overwriting of arbitrary files on the API server filesystem. This can compromise confidentiality and integrity of the system where the worker log folder is shared with the API server. The vulnerability does not affect deployments with separate log volumes for worker and API server. There are no known exploits in the wild at this time.

Users should upgrade to Apache Airflow version 3.2.2 or later, where this vulnerability is addressed. As an additional defense-in-depth measure, deploy the worker and API server with separate log volumes to prevent worker-controlled paths from accessing the API server's filesystem. Patch status is not explicitly confirmed in the provided data, but the vendor advisory recommends upgrading to 3.2.2 or later, indicating an official fix is available.