activepieces File URL file.ts handleUrlFile server-side request forgery_CVE-2026-12813

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Description

A vulnerability was detected in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/server/engine/src/lib/variables/processors/file.ts of the component File URL Handler. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Basic Information

ID CVE-2026-12813

Source VulDB

Published Jun 21, 2026 at 22:30

Affected Product

Vendor n/a

Product activepieces

Version 0.1

Affected Versions n/a activepieces 0.1
n/a activepieces 0.2
n/a activepieces 0.3
n/a activepieces 0.4
n/a activepieces 0.5
n/a activepieces 0.6
n/a activepieces 0.7
n/a activepieces 0.8
n/a activepieces 0.9
n/a activepieces 0.10
n/a activepieces 0.11
n/a activepieces 0.12
n/a activepieces 0.13
n/a activepieces 0.14
n/a activepieces 0.15
n/a activepieces 0.16
n/a activepieces 0.17
n/a activepieces 0.18
n/a activepieces 0.19
n/a activepieces 0.20
n/a activepieces 0.21
n/a activepieces 0.22
n/a activepieces 0.23
n/a activepieces 0.24
n/a activepieces 0.25
n/a activepieces 0.26
n/a activepieces 0.27
n/a activepieces 0.28
n/a activepieces 0.29
n/a activepieces 0.30
n/a activepieces 0.31
n/a activepieces 0.32
n/a activepieces 0.33
n/a activepieces 0.34
n/a activepieces 0.35
n/a activepieces 0.36
n/a activepieces 0.37
n/a activepieces 0.38
n/a activepieces 0.39
n/a activepieces 0.40
n/a activepieces 0.41
n/a activepieces 0.42
n/a activepieces 0.43
n/a activepieces 0.44
n/a activepieces 0.45
n/a activepieces 0.46
n/a activepieces 0.47
n/a activepieces 0.48
n/a activepieces 0.49
n/a activepieces 0.50
n/a activepieces 0.51
n/a activepieces 0.52
n/a activepieces 0.53
n/a activepieces 0.54
n/a activepieces 0.55
n/a activepieces 0.56
n/a activepieces 0.57
n/a activepieces 0.58
n/a activepieces 0.59
n/a activepieces 0.60
n/a activepieces 0.61
n/a activepieces 0.62
n/a activepieces 0.63
n/a activepieces 0.64
n/a activepieces 0.65
n/a activepieces 0.66
n/a activepieces 0.67
n/a activepieces 0.68
n/a activepieces 0.69
n/a activepieces 0.70
n/a activepieces 0.71
n/a activepieces 0.72
n/a activepieces 0.73
n/a activepieces 0.74
n/a activepieces 0.75
n/a activepieces 0.76
n/a activepieces 0.77
n/a activepieces 0.78
n/a activepieces 0.79
n/a activepieces 0.80
n/a activepieces 0.81
n/a activepieces 0.82
n/a activepieces 0.83.0

CWE Classification

CWE-918

References

{
    "lastseen": "",
    "description": "A vulnerability was detected in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/server/engine/src/lib/variables/processors/file.ts of the component File URL Handler. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
    "published": "2026-06-21T22:30:09.414Z",
    "modified": "2026-06-21T22:30:09.414Z",
    "type": "cve",
    "title": "activepieces File URL file.ts handleUrlFile server-side request forgery",
    "source": "VulDB",
    "references": "https://vuldb.com/vuln/372607\nhttps://vuldb.com/vuln/372607/cti\nhttps://vuldb.com/cve/CVE-2026-12813\nhttps://vuldb.com/submit/837553\nhttps://github.com/dxz0069/softwareoverflow/blob/main/activepieces_file_property_url_ssrf_vulndb.md",
    "id": "CVE-2026-12813",
    "bulletinFamily": "",
    "cwe": [
        "CWE-918"
    ],
    "cvelist": null,
    "sourceData": "n/a activepieces 0.1\nn/a activepieces 0.2\nn/a activepieces 0.3\nn/a activepieces 0.4\nn/a activepieces 0.5\nn/a activepieces 0.6\nn/a activepieces 0.7\nn/a activepieces 0.8\nn/a activepieces 0.9\nn/a activepieces 0.10\nn/a activepieces 0.11\nn/a activepieces 0.12\nn/a activepieces 0.13\nn/a activepieces 0.14\nn/a activepieces 0.15\nn/a activepieces 0.16\nn/a activepieces 0.17\nn/a activepieces 0.18\nn/a activepieces 0.19\nn/a activepieces 0.20\nn/a activepieces 0.21\nn/a activepieces 0.22\nn/a activepieces 0.23\nn/a activepieces 0.24\nn/a activepieces 0.25\nn/a activepieces 0.26\nn/a activepieces 0.27\nn/a activepieces 0.28\nn/a activepieces 0.29\nn/a activepieces 0.30\nn/a activepieces 0.31\nn/a activepieces 0.32\nn/a activepieces 0.33\nn/a activepieces 0.34\nn/a activepieces 0.35\nn/a activepieces 0.36\nn/a activepieces 0.37\nn/a activepieces 0.38\nn/a activepieces 0.39\nn/a activepieces 0.40\nn/a activepieces 0.41\nn/a activepieces 0.42\nn/a activepieces 0.43\nn/a activepieces 0.44\nn/a activepieces 0.45\nn/a activepieces 0.46\nn/a activepieces 0.47\nn/a activepieces 0.48\nn/a activepieces 0.49\nn/a activepieces 0.50\nn/a activepieces 0.51\nn/a activepieces 0.52\nn/a activepieces 0.53\nn/a activepieces 0.54\nn/a activepieces 0.55\nn/a activepieces 0.56\nn/a activepieces 0.57\nn/a activepieces 0.58\nn/a activepieces 0.59\nn/a activepieces 0.60\nn/a activepieces 0.61\nn/a activepieces 0.62\nn/a activepieces 0.63\nn/a activepieces 0.64\nn/a activepieces 0.65\nn/a activepieces 0.66\nn/a activepieces 0.67\nn/a activepieces 0.68\nn/a activepieces 0.69\nn/a activepieces 0.70\nn/a activepieces 0.71\nn/a activepieces 0.72\nn/a activepieces 0.73\nn/a activepieces 0.74\nn/a activepieces 0.75\nn/a activepieces 0.76\nn/a activepieces 0.77\nn/a activepieces 0.78\nn/a activepieces 0.79\nn/a activepieces 0.80\nn/a activepieces 0.81\nn/a activepieces 0.82\nn/a activepieces 0.83.0",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "activepieces",
    "version": "0.1",
    "vendor": "n/a",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}