BIT-NIFI-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

com.ahome-it:ahome-tooling-server-core (>=1.1.1-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.1-release, <=1.1.3-release) +20 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (3.6.0)

com.rabbitmq:amqp-client MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.1-release, =1.1.1-release, =1.1.1-release, =1.1.1-release,...

CVE-2026-87976

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

CVE-2026-87976

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

EUVD-2026-81075

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

CVE-2026-87976

Apache NiFi Registry versions 0.4.0 through 2.11.0 are vulnerable to path manipulation in the default file persistence provider. When storing extension bundle content, the provider used group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without reje...

CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

CVE-2026-87976: Improper Limitation of a Pathname to a Restricted Directory

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

PT-2026-93941

Name of the Vulnerable Software and Affected Versions Apache NiFi Registry versions 0.4.0 through 2.11.0 Description An issue exists during the storage of extension bundle content when using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provide...

com.ahome-it:ahome-tooling-server-core (>=1.1.1-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.1-release, <=1.1.3-release) +20 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.6.0)

com.rabbitmq:amqp-client MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.1-release, =1.1.1-release, =1.1.1-release, =1.1.1-release,...

org.apache.camel.maven:camel-salesforce-maven-plugin (>=4.19.0, <=4.20.0), org.apache.camel.quarkus:camel-quarkus-integration-test-salesforce (>=3.35.0, <=3.36.0) +6 more potentially affected by CVE-2026-49099 via org.apache.camel:camel-salesforce (>=4.19.0, <=4.20.0)

org.apache.camel:camel-salesforce MAVEN version =4.19.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 - org.apache.nifi:nifi-salesforce-nar 2.10.0 - org.apache.nifi:nifi-salesforce-processors 2.10.0 Source cves: CVE-2026-49099 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875080...

org.apache.nifi:nifi-framework-nar (1.12.1), org.apache.nifi:nifi-system-test-suite (1.12.1) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.12.1)

org.apache.nifi:nifi-jetty MAVEN version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.12.1 - org.apache.nifi:nifi-system-test-suite 1.12.1 Source cves:...

org.apache.nifi:nifi-framework-nar (1.0.0) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.0.0)

org.apache.nifi:nifi-jetty MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.0.0 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...

org.apache.nifi:nifi-framework-nar (1.8.0) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.8.0)

org.apache.nifi:nifi-jetty MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.8.0 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...

org.apache.nifi:nifi-framework-nar (1.11.4), org.apache.nifi:nifi-system-test-suite (1.11.4) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.11.4)

org.apache.nifi:nifi-jetty MAVEN version 1.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.11.4 - org.apache.nifi:nifi-system-test-suite 1.11.4 Source cves:...

org.apache.nifi:nifi-framework-nar (0.5.1) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (0.5.1)

org.apache.nifi:nifi-jetty MAVEN version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 0.5.1 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...

org.apache.nifi:nifi-framework-nar (1.9.1) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.9.1)

org.apache.nifi:nifi-jetty MAVEN version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.9.1 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...

org.apache.nifi:nifi-framework-nar (1.4.0) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.4.0)

org.apache.nifi:nifi-jetty MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.4.0 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...