The vulnerability arises from improper limitation of pathname to a restricted directory (CWE-22) in Apache Storm Nimbus. Specifically, the topology's 'topology.blobstore.map' allows submitters to choose local names for blobs that are used to build filesystem paths without normalization in AsyncLocalizer and Container.createBlobstoreLinks. This enables attackers to use '../' path traversal sequences to direct deletion and symlink creation operations at arbitrary paths on nodes where the topology runs, as the supervisor user. This can lead to recursive deletion of supervisor-owned content and planting symlinks that cause subsequent worker launches to execute attacker-controlled code as another tenant's OS user, defeating the isolation intended by 'supervisor.run.worker.as.user'. The vulnerability affects versions >=3.0.0 and <3.1.0. The fix in 3.1.0 enforces that resolved paths must lie inside the expected root directory at both vulnerable call sites. As a mitigation, restricting topology submission to trusted principals and rejecting submissions with path separators or '..' segments in 'topology.blobstore.map' entries is recommended for those who cannot upgrade immediately.

An attacker who can submit topologies can exploit this vulnerability to perform arbitrary file deletions and plant symlinks that lead to execution of attacker-chosen code as other tenants' OS users on every node the topology is scheduled onto. This breaks the intended isolation between tenants and can lead to privilege escalation and compromise of supervisor-owned content.

Upgrade Apache Storm Nimbus to version 3.1.0 or later, where the vulnerability is fixed by enforcing path normalization and restricting resolved paths to the expected root directory. If immediate upgrade is not possible, restrict topology submission to trusted principals only and reject any topology submissions whose 'topology.blobstore.map' entries contain path separators or '..' segments before they reach Nimbus.