Description

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-14T22:16:59.217Z",
  "pubdate": "2026-09-14T22:16:59.217Z",
  "executiveSummary": "Activiti, through version 7.1.0.M6, contains a critical expression injection vulnerability due to insufficient validation of deferred expressions in process variables.\nThe vulnerability allows an attacker to bypass expression filtering mechanisms, enabling the execution of arbitrary code within the application context.\nBy injecting malicious #{...} expressions, an attacker can influence the evaluation logic triggered during mail task execution, specifically when utilizing variable-backed body fields.\nSuccessful exploitation grants an attacker the ability to perform method invocation on application beans, potentially leading to Remote Code Execution (RCE), unauthorized data access, or complete system compromise.\nThis vulnerability poses a severe risk to the integrity and availability of the Activiti engine and the host environment.\nExploitation requires the attacker to have the ability to influence process variable content, which is then processed by a mail task.\nNo specific authentication or privilege escalation is inherently required if an attacker can submit process definitions or manipulate process variable inputs exposed by the workflow application.",
  "technicalDetails": "The root cause of this vulnerability lies in the inadequate sanitization and validation of process variables that are subsequently parsed by the Expression Language (EL) engine.\nActiviti employs an expression filtering mechanism designed to restrict the evaluation of potentially malicious expressions; however, this filter fails to account for deferred expressions formatted as #{...} sequences.\nThe vulnerability manifests primarily within the mail task component of the Activiti engine. When a mail task is configured to use variable-backed body fields, the engine retrieves these variables and attempts to resolve their content.\nIf an attacker successfully injects a crafted #{...} payload into a process variable, the expression filter fails to intercept or neutralize the sequence. During the execution phase of the mail task, the engine evaluates this variable within the full Spring application context.\nBecause the evaluation occurs within the Spring container's context, the injected expression has access to the application's bean registry. An attacker can leverage this by crafting expressions that invoke methods on existing beans.\nThe attack flow proceeds as follows: 1) The attacker introduces a malicious string containing an EL expression into a process variable that the system is expected to treat as standard text. 2) The process reaches a mail task execution node. 3) The mail task component extracts the tainted variable. 4) The EL evaluator processes the tainted string because the filter does not recognize the deferred expression syntax. 5) The expression is executed within the Spring context, allowing the attacker to perform arbitrary method invocations on beans present in the application context.\nThis behavior bypasses intended sandbox restrictions, effectively escalating the attacker's ability from merely injecting text to executing logic within the application's runtime environment.\nAffected versions include all versions of Activiti up to and including 7.1.0.M6. The impact is significant as it transforms a data-handling process into a vector for arbitrary code execution, allowing the attacker to interact with the application's backend services, potentially extract sensitive configuration information, or disrupt service availability."
}