The GCSToSambaOperator concatenates GCS object names into the SMB destination path without ensuring the resulting path stays inside the configured directory, allowing an object name containing "../" segments to escape the intended directory and overwrite or create files at arbitrary locations on the Samba target, which can lead to data loss or service disruption.

All installations of the Apache Airflow Samba provider before version 4.12.6 are affected; the vulnerability exists in the GCSToSambaOperator component used when transferring objects from Google Cloud Storage to a Samba share.

The vulnerability is not listed in CISA KEV. The EPSS score is less than 1%, indicating a low but non-zero probability of exploitation. The path traversal allows an attacker who can write objects into the source GCS bucket to access arbitrary locations on the Samba target when the GCSToSambaOperator runs, potentially leading to unauthorized data modification, overwrites, or denial of service.