CVE-2026-48499
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In Activepieces before version 0.84.0, an unsanitized path segment in the Code piece sandbox lets an authenticated flow author read and write cached flow and code files belonging to other tenants on the same worker. This can expose embedded data and allow modified code to execute on a victim tenant's next flow run.
Risk Assessment
An attacker can access sensitive data of other tenants and execute malicious code in their context, leading to tenant isolation breach.
Recommendation
Update Activepieces to version 0.84.0 or later, which contains the fix.
Original NVD description (English source)
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.