---
title: "CVE-2024-27317: Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification"
url: https://erroneo.us/security/cve/CVE-2024-27317/
description: "CVE-2024-27317 (org.apache.pulsar:pulsar-functions-worker (Maven)): In Pulsar Functions Worker, authenticated users can upload functions in jar or nar…"
type: vulnerability-record
section: "Security Digest"
date_published: 2024-03-12
date_modified: 2025-02-13
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2024-27317"
kev: false
cvss: 8.4
epss: 0.56934
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-27317: Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 56.9% , percentile 99: FIRST’s model estimates a 56.9% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes org.apache.pulsar:pulsar-functions-worker (Maven) >= 2.4.0, < 2.10.6, fixed in 2.10.6 ; org.apache.pulsar:pulsar-functions-worker (Maven) >= 2.11.0, < 2.11.4, fixed in 2.11.4 ; org.apache.pulsar:pulsar-functions-worker (Maven) >= 3.0.0, < 3.0.3, fixed in 3.0.3 ; org.apache.pulsar:pulsar-functions-worker (Maven) >= 3.1.0, < 3.1.3, fixed in 3.1.3 . Check your lockfile, including transitive dependencies.

## What it is

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

## Affected packages

- Maven `org.apache.pulsar:pulsar-functions-worker` >= 2.4.0, < 2.10.6 → fixed: 2.10.6
- Maven `org.apache.pulsar:pulsar-functions-worker` >= 2.11.0, < 2.11.4 → fixed: 2.11.4
- Maven `org.apache.pulsar:pulsar-functions-worker` >= 3.0.0, < 3.0.3 → fixed: 3.0.3
- Maven `org.apache.pulsar:pulsar-functions-worker` >= 3.1.0, < 3.1.3 → fixed: 3.1.3
- Maven `org.apache.pulsar:pulsar-functions-worker` >= 3.2.0, < 3.2.1 → fixed: 3.2.1

## Affected products (CVE record)

- Apache Software Foundation Apache Pulsar: 2.4.0 < 2.10.6, 2.11.0 < 2.11.4, 3.0.0 < 3.0.3, 3.1.0 < 3.1.3, 3.2.0 < 3.2.1

## Severity

- apache CVSS 3.1: 8.4 `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 56.93% probability of exploitation activity in the next 30 days; percentile 99.

## Sources

- [pulsar.apache.org](https://pulsar.apache.org/security/CVE-2024-27317/)
- [GitHub Advisory GHSA-jg2g-4rjg-cmqh](https://github.com/advisories/GHSA-jg2g-4rjg-cmqh)
- [CVE.org record CVE-2024-27317](https://www.cve.org/CVERecord?id=CVE-2024-27317)
- [NVD entry CVE-2024-27317](https://nvd.nist.gov/vuln/detail/CVE-2024-27317)
- [lists.apache.org](https://lists.apache.org/thread/ct9xmvlf7lompc1pxvlsb60qstfsm9po)
- [openwall.com](http://www.openwall.com/lists/oss-security/2024/03/12/10)

---
Source page: https://erroneo.us/security/cve/CVE-2024-27317/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt