CVE-2026-105945: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Software Foundation Apache Pulsar

The Apache Pulsar Packages Management Service, when configured to use the filesystem storage provider, improperly validates the version component of package names. This component can contain URL-encoded path separators and parent directory references, enabling path traversal. As a result, an authenticated user with package permissions on any namespace can manipulate packages belonging to other tenants or namespaces by downloading, overwriting, or deleting them. The containment checks in recent releases do not prevent this access because the resolved paths remain inside the configured storage directory. This vulnerability affects Apache Pulsar versions >=2.10.0 <4.0.14 and >=4.1.0 <4.2.5 when package management is enabled with the filesystem storage provider. The default configuration, which uses Apache BookKeeper, is not vulnerable.

An authenticated user with package permissions on any namespace can exploit this vulnerability to access, overwrite, or delete packages belonging to other tenants or namespaces without authorization. This compromises the integrity and availability of Pulsar Functions, Sources, or Sinks that depend on these packages. If authentication is disabled, any client with access to the broker's admin REST API can perform these operations. The vulnerability does not affect deployments where package management is disabled or where the default storage provider is used.

A fix is available. Users should upgrade Apache Pulsar to at least version 4.0.14 if using the 4.0.x line, or to at least version 4.2.5 if using the 4.1.x or 4.2.x lines. Users on versions prior to these should upgrade to these patched versions or newer. Additionally, package management is disabled by default; disabling it if not needed reduces exposure. The default storage provider (Apache BookKeeper) is not affected. No other mitigations are specified.