CVE-2026-53535 Details

A vulnerability in the git-sync feature of Activepieces, an open-source AI workflow automation platform, prior to version 0.82.0, allows for arbitrary file overwrites on the host filesystem. This issue arises from two main weaknesses: first, Git's symbolic-link handling was not disabled during the cloning process, enabling an attacker to manipulate write locations by including symlinks in a controlled repository; second, user-supplied identifiers used to construct file paths were not properly validated, allowing directory traversal sequences to escape intended directories. On self-hosted Enterprise Edition deployments, a user with the WRITE_PROJECT_RELEASE permission could exploit this vulnerability to overwrite files in locations writable by the Activepieces process user, potentially leading to unauthorized file modifications, service disruptions, or even remote code execution.

Users can upgrade to Activepieces version 0.82.0, which addresses the vulnerability by disabling symlink handling, validating user inputs to prevent directory traversal, and implementing a realpath-based escape check before file writes. Until upgrading, Git-sync can be disabled or restricted to trusted administrators, and existing Git remotes should be audited to ensure they point only to controlled repositories.