Is CVE-2026-53535 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53535 being exploited in the wild.

How severe is CVE-2026-53535?

Informational severity, with a CVSS score of 5.9, published 16 July 2026.

Is there a fix for CVE-2026-53535?

A patch was published on 2026-04-20: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53535 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53535?

Check whether you run Activepieces at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53535: Activepieces path traversal and symlink follow in git-sync

CVE-2026-53535 · Severity: info · CVSS 5.9 · Published 2026-07-16

Activepieces is an automation platform used to connect different software tools and AI services. A security flaw in its 'git-sync' feature allows an authorized user to trick the system into overwriting critical files on the server. This could lead to a complete system shutdown, data tampering, or allow an attacker to take full control of the server.

Technologies: Activepieces. Vendors: Activepieces.

Quick answers

Is CVE-2026-53535 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53535 being exploited in the wild.
How severe is CVE-2026-53535?: Informational severity, with a CVSS score of 5.9, published 16 July 2026.
Which products and versions are affected?: Activepieces < 0.82.0.
Is there a fix for CVE-2026-53535?: A patch was published on 2026-04-20: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53535 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53535?: Check whether you run Activepieces at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Activepieces prior to version 0.82.0 contains two vulnerabilities in the git-sync feature: a path traversal vulnerability (CWE-22) and improper link resolution (CWE-59). The system failed to disable symbolic-link handling during Git clones and did not validate user-supplied identifiers (repository slugs and externalIds) against directory-traversal sequences like '../'. An attacker with WRITE_PROJECT_RELEASE permissions can provide a malicious Git repository or crafted identifiers to redirect file writes to arbitrary locations on the host filesystem. This can result in arbitrary file overwrite, potentially leading to Remote Code Execution (RCE) or Denial of Service (DoS). The issue is fixed in version 0.82.0 by disabling symlinks in the temporary clone and implementing strict path validation.

Affected products

Activepieces Activepieces < 0.82.0

Timeline

2026-04-20: patched: Fix committed to main branch
2026-04-23: advisory: Version 0.82.0 released
2026-07-16: disclosed: CVE-2026-53535 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.