PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53535 activepieces CVE debrief

CVE-2026-53535 is a MEDIUM severity vulnerability in Activepieces, an open-source AI workflow automation platform. The git-sync feature clones a user-configured Git repository into a temporary directory on the server. Prior to version 0.82.0, two weaknesses allowed writes to escape the intended workspace and land on arbitrary paths on the host filesystem. An attacker with WRITE_PROJECT_RELEASE permission could cause the server to overwrite files anywhere the Activepieces process user can write, potentially leading to tampering, denial of service, or remote code execution.

Vendor
activepieces
Product
Unknown
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-16
Original CVE updated
2026-07-17
Advisory published
2026-07-16
Advisory updated
2026-07-17

Who should care

Self-hosted Enterprise Edition deployments of Activepieces are affected. Users with WRITE_PROJECT_RELEASE permission who can configure or push to a git-sync repository are at risk. Administrators and security teams responsible for Activepieces deployments should assess and mitigate this vulnerability.

Technical summary

The vulnerability arises from two weaknesses in the git-sync feature of Activepieces. Firstly, Git's symbolic-link handling was not disabled during the clone process, allowing an attacker-controlled remote repository to include symlinks that could redirect writes. Secondly, user-supplied identifiers (repository slug and externalId of tables, flows, and connections) were not validated against directory-traversal sequences like ../. These weaknesses combined enabled an attacker to write to arbitrary locations on the host filesystem. The issue was fixed in version 0.82.0.

Defensive priority

Apply the patch by upgrading to Activepieces version 0.82.0 or later. Restrict WRITE_PROJECT_RELEASE permissions to trusted users. Monitor git-sync repository configurations and user activities. Implement additional access controls and file system restrictions for the Activepieces process user.

Recommended defensive actions

  • Upgrade to Activepieces version 0.82.0 or later
  • Restrict WRITE_PROJECT_RELEASE permissions to trusted users
  • Monitor git-sync repository configurations and user activities
  • Implement additional access controls and file system restrictions for the Activepieces process user
  • Conduct regular security audits and vulnerability assessments

Evidence notes

The CVE record was published on 2026-07-16T19:16:50.097Z and has not been modified since then. The NVD entry is currently empty. Evidence limits suggest verifying the Activepieces version and git-sync feature usage. Defenders should check for unauthorized repository configurations and monitor user activities with WRITE_PROJECT_RELEASE permission. Conduct regular security audits and vulnerability assessments to ensure the platform's security posture. Additional verification tasks may be required to confirm the vulnerability's impact and validate mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53535 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53535

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53535 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53535

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.