Directory Traversal

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Directory Traversal via the uploadedJarLocation argument in the submitTopology and submitTopologyWithOpts processes. An attacker can access arbitrary files...

CVE-2026-82426 Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...