CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest resulting in file system operations outside of the file persistence directory. Upgrading to Apache NiFi Registry 2.12.0 is the recommended mitigation, which rejects parent-directory coordinates and requires a normalized path to remain a strict child of the storage root location.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache NiFi Registryto a version that resolves this vulnerability.Fixed in 2.12.0 - Compensating control
Until upgraded, prevent exploitation by restricting authenticated users’ ability to upload crafted extension bundles (e.g., limit who can write and delete bundles in the bucket to only trusted users).
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must be authorized to write and delete extension bundles in a bucket. The issue is therefore relevant to deployments where such bundle-management permissions are granted to untrusted or insufficiently trusted users.
Is the default storage configuration affected?
Yes. The affected component is the default file persistence provider, which used uploaded NAR manifest group, artifact, and version coordinates as filesystem path components.
What can exploitation allow?
A user can upload a NAR with crafted manifest coordinates and cause file-system operations outside the configured file persistence directory. The described operations include those performed while storing extension bundle content.
What should be done if upgrading cannot happen immediately?
Restrict write and delete permissions for bundles in buckets to highly trusted authenticated users. This reduces access to the capability required to upload a crafted NAR manifest.
How is this fixed?
Upgrade to Apache NiFi Registry 2.12.0. That version rejects parent-directory coordinate names and verifies that the normalized path is a strict child of the storage root.