CVE-2026-87976

Apache NiFi Registry 0.4.0 through 2.11.0 is vulnerable to path manipulation (CWE-22) in the default file persistence provider, which builds storage paths for extension bundles from the group, artifact, and version coordinates in an uploaded NAR manifest without rejecting parent-directory names, while its path-containment check compares an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest, causing file system operations outside the file persistence directory. The attacker gains the ability to write to or delete files elsewhere on the host, producing high integrity and availability impact, though the CVSS score indicates no direct confidentiality impact. All NiFi Registry deployments in the 0.4.0-2.11.0 range are affected where any account holds bundle write/delete permissions, since exploitation requires valid low-privileged credentials. No public proof of concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade all NiFi Registry instances to 2.12.0, which rejects parent-directory coordinates and requires a normalized path to remain a strict child of the storage root. Until upgraded, restrict write and delete permissions for extension bundles to fully trusted accounts and review buckets for NARs whose group, artifact, or version coordinates contain parent-directory sequences. Check the host filesystem around the file persistence directory for unexpected files or missing data that could indicate prior abuse.