Path traversal in Apache Pulsar - CVE-2026-105945
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to download, overwrite or delete packages in other tenants or namespaces without authorization, potentially compromising the integrity and availability of Pulsar Functions, Sources or Sinks that use those packages.
The vulnerability exists due to path traversal in the Apache Pulsar filesystem package storage provider when resolving package names containing unvalidated version components. A remote user can submit package operations with URL-encoded path separators and parent directory references in the version component, using packages permission on any namespace to access or modify packages belonging to other tenants or namespaces.
Exploitation requires package management to be enabled through enablePackagesManagement and FileSystemPackagesStorageProvider to be selected through packagesManagementStorageProvider.