CVE-2026-91145

Activiti through version 7.1.0.M6 fails to validate hash-brace (#{...}) deferred expressions supplied in process variables, allowing attackers to bypass the product's expression filtering. A low-privileged attacker who can set process variables can store a malicious #{ expression that is later evaluated in the full Spring application context when a mail task renders a variable-backed body field. Successful exploitation enables arbitrary method invocation on application beans, which can lead to data exposure, tampering, or remote code execution depending on what the beans expose. This affects any deployment of Alfresco's open-source Activiti BPM engine up to and including 7.1.0.M6 where user-influenced process variables feed mail task body fields. No public proof of concept is known and the flaw is not listed in the CISA KEV catalog.

What to do: Upgrade Activiti to a release newer than 7.1.0.M6 once a fixed version is published by Alfresco/Activiti maintainers. In the interim, avoid binding user-controllable process variables directly into mail task body (or other template) fields, and reject or sanitize inputs containing '#{'. Review audit logs and process history for unexpected expression evaluation or calls on Spring beans originating from process variables, and restrict which authenticated users or services can start processes and set variables.