CVE-2026-91145: Activiti through 7.1.0.M6 Expression Injection via Mail Task
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when a mail task uses process variables as body fields and an attacker can supply or influence those variables. The stored value is later evaluated in the full Spring context.
What does an attacker need to exploit it?
The attacker needs the ability to inject a process-variable value beginning with #{. The vulnerable expression filtering can be bypassed, allowing deferred expressions to be stored and later evaluated.
What is the potential impact after successful exploitation?
A successful expression can invoke methods on application beans available in the Spring context. The reported impact includes high confidentiality impact and low integrity impact.