CVE-2026-91145

Name of the Vulnerable Software and Affected Versions Activiti versions prior to 7.1.0.M7

Description Failure to validate hash-brace deferred expressions in process variables allows attackers to bypass expression filtering. By injecting expressions starting with #{, an attacker can store these expressions, which are subsequently evaluated within the full Spring context when a mail task utilizes variable-backed body fields. This mechanism enables unauthorized method invocation on application beans.

Recommendations Update to a version later than 7.1.0.M6.