CVE-2026-50203 is a critical path traversal vulnerability in the Apache Airflow SFTP provider affecting all versions before 5.8.1. The flaw allows a remote SFTP server, potentially malicious or compromised, to write files outside the designated local destination directory by crafting directory-entry names. This vulnerability can be exploited without any Airflow user authentication, thus any Airflow deployment that downloads directories from untrusted SFTP servers is at risk. The vulnerability is addressed by upgrading to version 5.8.1 or later.

Successful exploitation can lead to unauthorized file writes outside the intended directory, potentially overwriting or creating arbitrary files on the local system. This can result in compromise of confidentiality and integrity of the affected system. The vulnerability does not impact availability. No authentication is required to exploit this issue, increasing the attack surface.

Upgrade the Apache Airflow SFTP provider to version 5.8.1 or later to remediate this vulnerability. No other official remediation or temporary fixes are indicated. Deployments should avoid downloading directories from untrusted SFTP servers until patched.