Medium severity · published Jun 21, 2026
CVE-2026-12813
activepieces File URL file.ts handleUrlFile server-side request forgery
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was detected in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/server/engine/src/lib/variables/processors/file.ts of the component File URL Handler. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
activepieces · Activepieces
0.1; 0.2; 0.3; 0.4; 0.5; 0.6; +34 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12813
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12813
github.com
https://github.com/dxz0069/softwareoverflow/blob/main/activepieces_file_property_url_ssrf_vulndb.md
vuldb.com
https://vuldb.com/cve/CVE-2026-12813
vuldb.com
https://vuldb.com/submit/837553
vuldb.com
https://vuldb.com/vuln/372607
vuldb.com
https://vuldb.com/vuln/372607/cti
More from activepieces
9.3
CVE-2026-48499
Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
8.7
CVE-2026-73081
Activepieces: Remote Code Execution via Command Injection in Code Step Name
7.6
CVE-2026-73083
Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading
6.1
CVE-2026-73084
Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint
5.9
CVE-2026-53535
Activepieces: Arbitrary file write in git-sync via path traversal and symlinks