Apache NiFi Registry vulnerabilities

2 known vulnerabilities in Apache NiFi Registry from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Apache NiFi Registry: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-87976Sep 16, 2026Apache

  Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem pa

• 8.8 High severity

  Apache NiFi: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33140Jun 15, 2022ApacheEPSS 3.52%

  The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUse