Threats affecting pkg:maven/Apache Software Foundation/org.apache.nifi.registry:nifi-registry-framework

Apache NiFi Registry versions 0.4.0 through 2.11.0 have a path traversal vulnerability (CWE-22) in the handling of extension bundle content. Authenticated users authorized to write and delete bundles can upload crafted manifests that cause file operations outside the intended storage directory. This is due to insufficient validation of path components derived from group, artifact, and version coordinates. The vulnerability is fixed in version 2.12.0 by rejecting parent-directory coordinates and enforcing normalized paths within the storage root.