The vulnerability is a server‑side request forgery (SSRF) triggered by the handleUrlFile function in the File URL Handler component of activepieces. An attacker can supply any URL, causing the server to perform requests to that address. This can lead to unauthorized data exfiltration, internal network reconnaissance, or further exploitation of resources behind the activepieces host. The flaw is a classic input‑validation weakness (CWE‑918) and can be executed remotely without authentication.

The flaw exists in activepieces versions up to and including 0.83.0. It affects the component located at packages/server/engine/src/lib/variables/processors/file.ts, which is part of the activepieces open‑source application. No other vendors or product lines are impacted.

The CVSS score is 5.3, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Public exploits are known, and the attack vector is remote; an attacker can trigger the SSRF by sending a crafted request to the affected endpoint. Because the flaw resides in internal processing and does not involve authentication bypass, an unauthenticated attacker can immediately exploit it, but successful exploitation may also require additional privileges or forward‑looking reconnaissance.