DEV Community

kozhevniko
kozhevniko

Posted on

Lessons from the Apache NiFi Bundle Traversal: When Trusted Metadata Becomes a Path Injection

#apachenifi #apachemyfaces #vulnerability #datapipeline

Lessons from the Apache NiFi Bundle Traversal: When Trusted Metadata Becomes a Path Injection

The general pattern

CVE-2026-87976 is a specific instance of a common design mistake. A trusted component receives metadata from an authenticated user, treats the values as opaque identifiers, and then uses them to construct a filesystem path. The persistence provider in NiFi Registry did exactly this, and because parent-directory names were not rejected, the resulting path could leave the storage root.

Why the authentication boundary misleads

Reviews often stop when a feature is gated behind a permission. The NiFi Registry flaw shows that the permission narrows the attacker set without containing the damage. Once an account is compromised, the remaining question is what that account can reach.

Translating the pattern into review questions

Where does the platform build filesystem paths from uploaded artefacts? Which fields inside those artefacts are attacker-controlled? Does the path construction reject traversal sequences, absolute paths and symbolic links? Is the resulting destination validated against the expected root after resolution?

The companion flaw in the same round

NiFi 2.11.0 also carried CVE-2026-70469, where Content-Encoding parsing drove memory exhaustion. The two sit at opposite ends of the request lifecycle, one at ingestion and one at storage, which is a reminder that a platform needs review at both.

Apply the fix and the questions

Upgrade the NiFi components to 2.12.0, and treat the review questions as durable rather than tied to this advisory.

Exploitation status

No confirmed in-the-wild exploitation for CVE-2026-87976 at publication time.

References

Top comments (0)