Executive brief
Apache NiFi Registry is used to store and manage data flow extensions. An authenticated user with bundle write permissions can upload a specially-crafted extension package with manipulated manifest coordinates to write files outside the intended storage directory, potentially compromising system integrity and enabling unauthorized data access or system compromise.
Technical details
This is a path traversal vulnerability in Apache NiFi Registry's file persistence provider. The vulnerable component fails to properly normalize and validate the filesystem paths constructed from group, artifact, and version coordinates parsed from NAR (NiFi Archive) manifest files. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with parent-directory references (e.g., "..") in the manifest coordinates, allowing file system operations outside the intended persistence directory. The vulnerability requires authentication and bundle write authorization, but does not require user interaction beyond uploading a malicious bundle. The fix in version 2.12.0 rejects parent-directory coordinates and enforces strict path normalization and containment checks.
Affected products
- Apache NiFi Registry 0.4.0 through 2.11.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in Apache NiFi Registry 2.12.0