{"action":"Upgrade apache-airflow-providers-samba to 4.12.6 or later.","affected":[{"fixed":"4.12.6","introduced":"0"}],"component":"apache-airflow-providers-samba","cve_ids":["CVE-2026-49818"],"ecosystem":"PyPI","epss":0.00624,"exploited":false,"fixed_versions":["4.12.6"],"ghsa_id":"GHSA-f6vj-48fm-hmvx","id":"tcs_01M5KGXBTHPBTN742QM4YYSBGB","modified_at":"2026-08-04T13:45:07.396094980Z","published_at":"2026-06-09T09:16:30.443Z","references":["https://osv.dev/vulnerability/PYSEC-2026-208","http://www.openwall.com/lists/oss-security/2026/06/09/8","https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf","https://github.com/apache/airflow/pull/67857","https://github.com/advisories/GHSA-f6vj-48fm-hmvx"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-208","url":"https://osv.dev/vulnerability/PYSEC-2026-208"}],"summary":"The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path o"}