CVE-2026-87976 is a vulnerability in Apache NiFi
Published on September 16, 2026
Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest resulting in file system operations outside of the file persistence directory. Upgrading to Apache NiFi Registry 2.12.0 is the recommended mitigation, which rejects parent-directory coordinates and requires a normalized path to remain a strict child of the storage root location.
Vulnerability Analysis
CVE-2026-87976 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-87976 has been classified to as a Directory traversal vulnerability or weakness.
Products Associated with CVE-2026-87976
Want to know whenever a new CVE is published for Apache NiFi? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache NiFi Registry:- Version 0.4.0, <= 2.11.0 is affected.