CVE-2026-12813

Name of the Vulnerable Software and Affected Versions activepieces versions prior to 0.83.0

Description A remote server-side request forgery (SSRF) exists in the File URL Handler component. The issue is located within the handleUrlFile() function in the packages/server/engine/src/lib/variables/processors/file.ts library. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the handleUrlFile() function to minimize the risk of exploitation.