CLEANSTART-2026-XW85321: Path-traversal vulnerability in QOS

Q: What does an attacker need to exploit this issue?

The vector is network-based and the attacker does not need privileges or user interaction. The CVSS data indicates that attack requirements are present, so exploitation depends on an additional condition not specified in the available advisory data.

Q: What impact is indicated if exploitation succeeds?

The available CVSS assessment indicates low impact to confidentiality, integrity, and availability of the vulnerable component. No impact to a subsequent system is indicated.

Q: Which deployments can be confirmed as affected?

The advisory identifies the cleanstart/apache-nifi software package, but does not provide affected versions, fixed versions, or configuration-specific exposure details. Use the referenced advisory records to determine whether a deployed version is in scope.

Published Nov 11, 2026

Updated

Security vulnerability affects the apache-nifi package. Path-traversal vulnerability in QOS.

Affected Software

1 affected componentFixes available

cleanstart/apache-nifi<2.11.0-r3

2.11.0-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.11.0-r3

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-104721

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vector is network-based and the attacker does not need privileges or user interaction. The CVSS data indicates that attack requirements are present, so exploitation depends on an additional condition not specified in the available advisory data.

What impact is indicated if exploitation succeeds?

The available CVSS assessment indicates low impact to confidentiality, integrity, and availability of the vulnerable component. No impact to a subsequent system is indicated.

Which deployments can be confirmed as affected?

The advisory identifies the cleanstart/apache-nifi software package, but does not provide affected versions, fixed versions, or configuration-specific exposure details. Use the referenced advisory records to determine whether a deployed version is in scope.

CLEANSTART-2026-XW85321: Path-traversal vulnerability in QOS

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What impact is indicated if exploitation succeeds?

Which deployments can be confirmed as affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What impact is indicated if exploitation succeeds?

Which deployments can be confirmed as affected?