CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Authenticated users can manipulate file paths to read or modify files outside the intended storage directory in Apache NiFi Registry.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87976?
CVE-2026-87976 is a high-severity path traversal vulnerability in Apache Nifi, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest resulting in file system operations outside of the file persistence directory. Upgrading to Apache NiFi Registry 2.12.0 is the recommended mitigation, which rejects parent-directory coordinates and requires a normalized path to remain a strict child of the storage root location.
Weakness: CWE-22
Which versions are affected by CVE-2026-87976?
1 open source package ship an affected version, including nifi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nifi Bitnami | From 0.4.0 | 2.12.0 |
Products include Apache Nifi.
How do I fix CVE-2026-87976?
Upgrade nifi to 2.12.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-87976 being exploited?
There is no known exploitation of CVE-2026-87976 in the wild and no public exploit code.
Other vulnerabilities in Apache Nifi
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Sources
Also known as BIT-nifi-2026-87976, GHSA-6ghg-hh2v-f99w, MINI-jgp8-2qhx-79qx.