This vulnerability (CWE-59) in Apache Airflow allows a DAG author to exploit improper symbolic link resolution in the FileTaskHandler. By creating a symlink in the task's log directory pointing to arbitrary files readable by the API server (read-path attack) or by supplying a specially crafted task_id containing '..' sequences (write-path attack), the log path can be resolved outside the configured base_log_folder. This results in unauthorized file disclosure or overwriting. The issue only affects deployments where the worker log folder is shared with the API server. The vendor recommends upgrading to Apache Airflow 3.2.2 or later and suggests separating log volumes for the worker and API server as a defense-in-depth measure.

An attacker with DAG author privileges can read sensitive files such as /etc/passwd or airflow.cfg or overwrite arbitrary files accessible by the API server process. This compromises confidentiality but does not impact integrity or availability directly. The vulnerability requires the worker log folder to be shared with the API server, limiting exposure to certain deployment configurations.

Upgrade Apache Airflow to version 3.2.2 or later, where this vulnerability is fixed. Additionally, as a defense-in-depth measure, deploy the worker and API server with separate log volumes to prevent worker-controlled paths from reaching the API server's filesystem. Patch status is confirmed by the vendor advisory recommending upgrade to 3.2.2.