CVE-2021-44145: Apache Nifi

Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days.

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

Affected products

• Apache Nifi: from 0.1.0, before 1.15.1 (fixed in 1.15.1)

Published 2021-12-17. Last modified 2026-06-17.