CVE-2026-53535
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
In Activepieces before version 0.82.0, the git-sync feature allowed writes to escape the intended workspace and land on arbitrary paths on the host filesystem. This was due to Git symbolic-link handling not being disabled and insufficient validation of user-supplied identifiers (repository slug, externalId of tables, flows, connections) against directory-traversal sequences.
Risk Assessment
An attacker with WRITE_PROJECT_RELEASE permission can overwrite any files writable by the Activepieces process, potentially leading to data tampering, denial of service, or remote code execution.
Recommendation
Upgrade Activepieces to version 0.82.0 or later immediately. Restrict git-sync feature access to trusted users only.
Other vulnerabilities in Activepieces
See all- CVE-2026-48499Critical
In Activepieces before version 0.84.0, an unsanitized path segment in the Code piece sandbox lets an authenticated flow author read and write cached flow and code files belonging to other tenants on the same worker. This can expose embedded data and allow modified code to execute on a victim tenant's next flow run.
- CVE-2026-73084Medium
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.
- CVE-2026-73083High
Activepieces prior to 0.80.0 in SANDBOX_CODE_ONLY mode loads the user module before applying the V8 isolate, allowing access to Node.js APIs outside the sandbox. An authenticated user can read environment secrets, files, and reach internal services.
- CVE-2026-73082Medium
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability. This issue is fixed in version 0.82.0.
- CVE-2026-73081High
Activepieces prior to 0.80.0 has a vulnerability in the code compilation pipeline where a step name can contain shell metacharacters, allowing arbitrary command execution during compilation. An authenticated user can execute commands as the worker process.
- CVE-2026-53536Medium
In Activepieces prior to version 0.83.0, the /v1/step-files/signed endpoint did not verify the JWT audience and lacked a null check for decoded fileId. This allowed an authenticated user to retrieve step-files belonging to other tenants on the same instance.
Original NVD description (English source)
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed those writes to escape the intended workspace and land on arbitrary paths on the host filesystem: Git's symbolic-link handling was not disabled on the clone, so an attacker who controlled the remote repository could include symlinks that redirected the writes, and several user-supplied identifiers used to build on-disk paths (the repository slug and the externalId of tables, flows, and connections) were not validated against directory-traversal sequences such as ../. On a self-hosted Enterprise Edition deployment, a user authorized to configure or push to a git-sync repository (holding the WRITE_PROJECT_RELEASE permission) could cause the server to overwrite files anywhere the Activepieces process user can write, which depending on host layout can be leveraged for tampering, denial of service, or remote code execution. This issue is fixed in version 0.82.0.