{
  "root_cause_equivalent": true,
  "confidence": "high",
  "parent_root_cause": "Attacker-controlled GCS object names are joined to filesystem/SFTP destination paths and then written without proving containment at the final write sink.",
  "variant_root_cause": "A GCS object name that is lexically inside destination_path is accepted by the fixed lexical check, but the SFTP server resolves an intermediate symlink and writes outside destination_path.",
  "shared_sink": "GCSToSFTPOperator._copy_single_object() -> SFTPHook.store_file(destination_path, tmp.name)",
  "shared_trust_boundary": "Less-trusted principal controls GCS object names returned by the source bucket listing API consumed by a trusted Airflow DAG.",
  "distinct_trigger": "No '..' object name is used; the bypass depends on symlink resolution under the configured SFTP destination tree.",
  "notes": "The variant is a bypass of the 22.2.1 lexical containment assumption for GCSToSFTPOperator. It is not a variant of GCSTimeSpanFileTransformOperator, whose local temp path uses Path.resolve()."
}