CVE-2026-116058: Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection
A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in code injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments may be affected?
Alfresco Activiti versions up to 7.21.0-rc.692 are reported as affected. The available information does not identify a fixed version or state whether any particular deployment configuration is unaffected.
What level of access does an attacker need?
The CVSS vector indicates that the attack can be initiated remotely with low attack complexity and requires low privileges. No user interaction is required.
What is the potential impact of successful exploitation?
Successful manipulation of JuelScriptEngine.eval can result in code injection. The reported CVSS metrics indicate low impact to confidentiality, integrity, and availability.
Is a vendor fix available?
The available disclosure states that the vendor was contacted but did not respond. It does not provide a patch, workaround, or fixed release.