CVE-2026-87976 in NiFi Registry
Summary
by MITRE • 09/16/2026
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest resulting in file system operations outside of the file persistence directory. Upgrading to Apache NiFi Registry 2.12.0 is the recommended mitigation, which rejects parent-directory coordinates and requires a normalized path to remain a strict child of the storage root location.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
Apache NiFi Registry versions ranging from 0.4.0 through 2.11.0 contain a critical directory traversal vulnerability that allows authenticated users with write permissions for specific buckets to execute arbitrary file system operations outside the intended application directories. This flaw stems from how the registry handles extension bundle content, specifically when storing artifacts defined by group, artifact, and version coordinates extracted directly from uploaded NAR manifests. The default file persistence provider in these vulnerable versions constructs filesystem paths using these coordinate strings as direct path components without implementing adequate sanitization to reject parent-directory traversal sequences such as dot-dot-slash or their encoded equivalents. Consequently, an attacker can craft a malicious manifest that includes carefully constructed version or artifact identifiers containing relative path navigation characters.
The technical root cause of this vulnerability lies in the insufficient validation logic applied during the file storage process. When the system resolves and normalizes paths to determine where to write bundle content, it fails to ensure that the resulting absolute path remains strictly within the designated storage root directory. The existing path-containment check compares an unnormalized resolved path against the base directory, which allows a crafted input to escape containment by leveraging relative path traversal mechanisms before normalization occurs or by exploiting inconsistencies in how paths are compared. This lack of strict boundary enforcement means that file system operations can be directed to arbitrary locations on the host operating system where the NiFi Registry service is running, provided the user has sufficient privileges to write files and delete bundles within a targeted bucket.
The operational impact of this vulnerability extends beyond simple data corruption or unauthorized access to registry metadata. By exploiting this path manipulation flaw, an authenticated attacker can overwrite critical configuration files, inject malicious code into executable directories, or potentially achieve remote code execution depending on the context in which the NiFi Registry process operates and its associated file permissions. This represents a significant security risk as it undermines the integrity of the entire Apache NiFi ecosystem, since compromised registry content could lead to the deployment of malicious processors or controllers across connected NiFi instances that pull bundles from the affected registry. The vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and is relevant to ATT&CK technique T1059 Command and Scripting Interpreter if used in conjunction with other exploitation methods, though primarily it facilitates unauthorized file system access which maps to privilege escalation or persistence mechanisms depending on the attacker's goals.
To mitigate this vulnerability, organizations must upgrade Apache NiFi Registry to version 2.12.0 or later immediately upon availability of a secure patch within their respective environments. The fixed versions address these issues by implementing robust input validation that explicitly rejects parent-directory coordinates in group, artifact, and version fields before they are used for path construction. Furthermore, the updated logic ensures that all resolved paths undergo strict normalization checks to verify that they remain strictly child directories of the configured storage root location, thereby preventing any form of directory traversal escape. Until an upgrade can be performed, administrators should restrict access to NiFi Registry buckets containing upload capabilities to only trusted and highly vetted users, although this is a compensating control rather than a definitive fix given the authenticated nature of the exploit.