Executive brief
Activepieces is an automation platform used to connect different software tools and AI services. A security flaw in its 'git-sync' feature allows an authorized user to trick the system into overwriting critical files on the server. This could lead to a complete system shutdown, data tampering, or allow an attacker to take full control of the server.
Technical details
Activepieces prior to version 0.82.0 contains two vulnerabilities in the git-sync feature: a path traversal vulnerability (CWE-22) and improper link resolution (CWE-59). The system failed to disable symbolic-link handling during Git clones and did not validate user-supplied identifiers (repository slugs and externalIds) against directory-traversal sequences like '../'. An attacker with WRITE_PROJECT_RELEASE permissions can provide a malicious Git repository or crafted identifiers to redirect file writes to arbitrary locations on the host filesystem. This can result in arbitrary file overwrite, potentially leading to Remote Code Execution (RCE) or Denial of Service (DoS). The issue is fixed in version 0.82.0 by disabling symlinks in the temporary clone and implementing strict path validation.
Affected products
- Activepieces Activepieces < 0.82.0
Timeline
- 2026-04-20: patched: Fix committed to main branch
- 2026-04-23: advisory: Version 0.82.0 released
- 2026-07-16: disclosed: CVE-2026-53535 published