CVE-2026-48499criticalCWE-200CWE-285CWE-668CWE-732

CVE-2026-48499: falha crítica em activepieces

Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache

Publicada em

Seguir esta CVE+ Monitorar activepieces

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.4%
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Produtos afetados
activepieces · activepieces
CVEs relacionadas — activepieces

No mesmo produto, das mais perigosas para as menos.

CVE-2026-53535MEDIUMActivepieces: Arbitrary file write in git-sync via path traversal and symlinksEPSS 0.8%CVE-2026-73081HIGHActivepieces: Remote Code Execution via Command Injection in Code Step NameEPSS 0.5%CVE-2026-73082MEDIUMActivepieces: Server-side request forgery in MCP tool validation endpointEPSS 0.4%CVE-2026-73084MEDIUMActivepieces: Reflected Cross-Site Scripting in OAuth Redirect EndpointEPSS 0.4%CVE-2026-73083HIGHActivepieces: V8 Isolate Sandbox Bypass via importFresh Module LoadingEPSS 0.3%CVE-2026-53536MEDIUMActivepieces: Cross-tenant file download via missing JWT audience check on step-files signed URLEPSS 0.2%