CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

As cited

Copy frozen at 2026-09-17 01:51 UTC (site build).

vulnerabilities

CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry versions 0.4.0 through 2.11.0 contain a path manipulation vulnerability in the default file persistence provider. The flaw allows attackers to exploit improperly validated group, artifact, and version coordinates from uploaded NAR manifests to write files outside intended directories.

Why it matters: Organizations deploying NiFi Registry for extension management face arbitrary file write risk; administrators should prioritize patching to version 2.12.0 or later.

Source published

2026-09-16 15:21 UTC

First seen by Cybersecurity Tracker

2026-09-16 17:33 UTC