PT-2026-66541 · Unknown · Activepieces
CVE-2026-48499
·
Published
2026-07-30
·
Updated
2026-07-30
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N |
Name of the Vulnerable Software and Affected Versions
Activepieces versions prior to 0.84.0
Description
An unsanitized path segment in the Code piece sandbox allows an authenticated flow author to access cached flow and code files of other tenants on the same worker with read-write permissions. This can lead to the exposure of embedded data and enable the execution of modified code during the next flow run of a victim tenant.
Recommendations
Update to version 0.84.0.
Exploit
Fix
Incorrect Permission
Exposure of Resource to Wrong Sphere
Improper Authorization
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Activepieces