https://seclists.org/oss-sec/2026/q3/808: CVE-2026-87976: Apache NiFi gistry: Improper Limitation of Pathname in Persisted Extension Bundles
Affected Software
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and authorized to write and delete extension bundles in a bucket. The issue is therefore most relevant where those bundle-management permissions are granted to untrusted or insufficiently trusted users.
Is the default storage configuration affected?
Yes. The vulnerable behavior is in the default file persistence provider, which used uploaded NAR manifest group, artifact, and version coordinates as filesystem path components.
What can an attacker do with a crafted bundle?
A user with the required bucket permissions can upload a NAR containing crafted manifest coordinates that cause filesystem operations outside the configured file persistence directory.
What is the recommended remediation?
Upgrade Apache NiFi Registry to version 2.12.0. This version rejects parent-directory coordinate values and verifies that the normalized path remains a strict child of the storage root.
What can be done while an upgrade is pending?
Restrict write and delete permissions for bundles in buckets to trusted users, since those permissions are required for exploitation.