CVE-2026-91145: Activiti through 7.1.0.M6 Expression Injection via Mail Task

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-14 · updated 2026-09-24
Weakness: CWE-917

Description

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.

Affected products

Activiti: through 7.1.0.M6

References

https://github.com/Activiti/Activiti
https://github.com/Activiti/Activiti/blob/7.1.0.M6/activiti-core/activiti-api-impl/activiti-api-process-runtime-impl/src/main/java/org/activiti/runtime/api/impl/ExpressionResolver.java
https://github.com/Activiti/Activiti/blob/7.1.0.M6/activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/bpmn/behavior/MailActivityBehavior.java
https://github.com/Activiti/Activiti/issues/5438
https://www.vulncheck.com/advisories/activiti-through-7.1.0-m6-expression-injection-via-mail-task
https://github.com/Activiti/Activiti/issues/5438

Get alerted when CVE-2026-91145 or the next vulnerability affects your stack