CVE-2026-48499

Deferred Deferred - Pending Action

Activepieces Path Traversal Vulnerability

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-48499

EUVD

EUVD-2026-51202

Affected Vendors & Products

Vendor	Product	Version / Range
activepieces	activepieces	to 0.84.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Activepieces before version 0.84.0 has a vulnerability where an unsanitized path segment in the Code piece sandbox allows an authenticated user to access read-write cached files of other tenants on the same worker. This exposes embedded data and enables modified code execution on a victim tenant's next flow run.

Detection Guidance

This vulnerability requires checking for unauthorized access to cached flow and code files between tenants. Review Activepieces logs for suspicious file access patterns, especially between different tenant IDs. Check file permissions on cached directories to ensure tenant isolation. Verify if any user has accessed files outside their designated tenant scope.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data from other tenants, enable code injection attacks, and potentially disrupt or manipulate workflows running on the same shared worker environment.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's security requirements for protected health information, potentially resulting in legal penalties and loss of trust.

Mitigation Strategies

Upgrade Activepieces to version 0.84.0 or later to address the vulnerability. Ensure no unauthorized access has occurred by reviewing cached flow and code files for suspicious modifications.

Hi! I’m here to help you understand CVE-2026-48499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70