CVE-2026-87976

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest resulting in file system operations outside of the file persistence directory. Upgrading to Apache NiFi Registry 2.12.0 is the recommended mitigation, which rejects parent-directory coordinates and requires a normalized path to remain a strict child of the storage root location.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87976.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "0.4.0"
                },
                {
                    "last_affected":  "2.11.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "introduced":  "0.4.0"
                },
                {
                    "fixed":  "2.11.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/apache/nifi

Affected ranges

Type

GIT

Repo

https://github.com/apache/nifi

Events

Introduced

b66c029090f395c0cbc001fd483e86895b133e46

Fixed

19f4df8e048e91d87d3e4967c69b1298f9dbe450

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0.4.0"
        },
        {
            "fixed":  "2.12.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87976.json"