CVE-2026-87976

Name of the Vulnerable Software and Affected Versions Apache NiFi Registry versions 0.4.0 through 2.11.0

Description An issue exists during the storage of extension bundle content when using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider uses these coordinates as filesystem path components without rejecting parent-directory names, and the path-containment check utilizes an unnormalized resolved path. This allows an authenticated user with permissions to write and delete bundles in a bucket to upload a NAR with a crafted manifest, enabling file system operations outside of the intended file persistence directory.

Recommendations Update Apache NiFi Registry to version 2.12.0.