An expression injection flaw in Camunda 7 allows authenticated users to inject arbitrary JUEL expressions through the orQueries field of TaskQueryDto. The vulnerability originates from a missing validation that lets attackers bypass the enableExpressionsInAdhocQueries restriction, enabling them to supply a malicious expression such as dueAfterExpression. When executed, the expression performs Java reflection and calls java.lang.Runtime.exec, yielding arbitrary operating‑system command execution with the privileges of the engine service user. The flaw aligns with the CWE-78 and CWE-917 vulnerability classes.

Camunda 7 with versions 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16 are affected. Updating to Camunda 7.24.14 or later, or to 7.23.17 or later, removes the vulnerability.

The vulnerability carries a CVSS score of 9.3, indicating a high likelihood of exploitation when present. The EPSS score is not available, but the lack of inclusion in the CISA KEV catalog does not diminish the severity. Attackers need only authenticated access to the Camunda engine, and can inject the malicious expression via an ad hoc query. Once executed, the injected JUEL expression can launch arbitrary system commands, compromising confidentiality, integrity, and availability of the host.