---
id: CVE-2026-87976
title: >-
  Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation
  when storing extension bundle content using group, artifact, and version
  coordinates from uploaded NAR manifests
summary: >-
  Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation
  when storing extension bundle content using group, artifact, and version
  coordinates from uploaded NAR manifests. The default file persistence provider
  used coord…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-22
vendor: apache
product: nifi
affected:
  - 'nifi >= 0.4.0, < 2.12.0'
patched:
  - nifi 2.12.0
published: '2026-09-16'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:14:51.633'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87976'
references:
  - url: 'https://lists.apache.org/thread/kw89toml5zq20ry3279mx7y184vrlb8x'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/16/11'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00667
epssPercentile: 0.50466
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T19:13:14.860962Z'
scores:
  nvd: 8.1
  cna: 7.2
ingestedAt: '2026-09-16T20:03:30.767Z'
---

## Overview

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest resulting in file system operations outside of the file persistence directory. Upgrading to Apache NiFi Registry 2.12.0 is the recommended mitigation, which rejects parent-directory coordinates and requires a normalized path to remain a strict child of the storage root location.

## Affected

- `nifi >= 0.4.0, < 2.12.0`

## Remediation

Upgrade past the affected range:

- `nifi 2.12.0`