As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Apache NiFi Registry versions 0.4.0 through 2.11.0 contain a path manipulation vulnerability in the default file persistence provider. The flaw allows attackers to exploit improperly validated group, artifact, and version coordinates from uploaded NAR manifests to write files outside intended directories.
Why it matters: Organizations deploying NiFi Registry for extension management face arbitrary file write risk; administrators should prioritize patching to version 2.12.0 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Apache NiFi Registry versions 0.4.0 through 2.11.0 fail to properly validate pathname construction when storing extension bundle content, allowing path manipulation through group, artifact, and version coordinates in NAR manifests. The default file persistence provider uses these coordinates directly as filesystem path components without adequate sanitization.
Why it matters: Organizations running affected Apache NiFi Registry versions risk unauthorized file writes or reads through malicious extension bundles; administrators should prioritize upgrading to patch this path traversal vulnerability.
- Source published
- First seen by Cybersecurity Tracker