CVE-2026-105945

The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and...

Apache Pulsar path traversal vulnerability

Path traversal vulnerabilities exist in Apache Pulsar versions 2.10.0 through 4.0.14 and 4.1.0 through 4.2.5. These vulnerabilities stem from the Pulsar Packages Management Service’s file system storage provider, which fails to validate version components within package names. These components ma...