Cpe:2.3:a:alfresco:activiti:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aalfrescoactiviti/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 14 Sep 2026 23:36:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-91145 Expression Injection in Activitihttps://feed.craftedsignal.io/briefs/2026-09-activiti-expression-injection/Mon, 14 Sep 2026 23:36:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-activiti-expression-injection/Activiti through 7.1.0.M6 contains an expression injection vulnerability in process variables that allows unauthenticated method invocation on application beans during mail task execution.Activiti through 7.1.0.M6 contains a critical vulnerability where the engine fails to properly validate hash-brace deferred expressions provided in process variables. This flaw allows an attacker to bypass existing expression filtering mechanisms. An attacker can inject malicious SpEL (Spring Expression Language) expressions starting with the "#{ " sequence into process variables. These variables are persisted by the application and later evaluated within the full Spring application context whenever a mail task is triggered that utilizes variable-backed body fields. Successful exploitation allows for unauthorized method invocation on application beans, potentially leading to arbitrary code execution or unauthorized access to sensitive application data. Defenders should focus on identifying inputs that contain the "#{" sequence and monitoring for unexpected Spring bean method invocations during process engine execution.

Impact

Successful exploitation of CVE-2026-91145 allows remote attackers to execute arbitrary methods within the Spring application context. This could result in full application compromise, unauthorized data exfiltration, or modification of business processes managed by the Activiti engine. Organizations using affected versions of Activiti to manage sensitive workflows are at high risk of internal unauthorized command or function execution.

Recommendation

  1. Upgrade to a version of Activiti that provides a security patch for CVE-2026-91145.
  2. Implement strict input validation on all process variables, specifically looking for and sanitizing the "#{ " pattern before the data reaches the persistence layer.
  3. Monitor web server logs for HTTP requests containing the "#{" sequence, which may indicate an attempt to inject malicious expressions into process variables.
  4. Review and restrict access to the Activiti management interface to prevent unauthorized process variable modification.
]]>highadvisoryexpression-injectionvulnerability