CVE-2026-105945

The Apache Pulsar Packages Management Service is vulnerable to a path traversal issue when using the filesystem storage provider . The service fails to validate the version component of package names, allowing it to contain URL-encoded path separators and parent directory references. This enables...