Apache NiFi Registry versions 0.4.0 through 2.11.0 are vulnerable to a path traversal (CWE-22) when storing extension bundle content. The vulnerability arises from using group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without rejecting parent-directory names. The path containment check compares an unnormalized resolved path, allowing an authenticated user with write and delete permissions on bundles to upload a crafted NAR manifest that results in file system operations outside the intended file persistence directory. The issue is fixed in Apache NiFi Registry 2.12.0, which rejects parent-directory coordinates and requires normalized paths to remain strictly within the storage root.

An authenticated user authorized to write and delete bundles in a bucket can exploit this vulnerability to perform unauthorized file system operations outside the designated storage directory. This could lead to unauthorized file modification, deletion, or creation outside the intended scope, potentially impacting system integrity and availability. The CVSS 4.0 score is 7.2 (high severity), reflecting network attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability with privileges required.

Upgrade Apache NiFi Registry to version 2.12.0 or later. This version includes a fix that rejects parent-directory coordinates and enforces normalized paths to remain strictly within the storage root directory, preventing path traversal. No other mitigations are indicated by the vendor advisory.