A flaw in Activepieces’ Code piece sandbox permits an authenticated flow author to use an unsanitized path segment, enabling read‑write access to cached flow and code files belonging to other tenants on the same worker. This can expose embedded data and allow the attacker to inject altered code that will run on a victim tenant’s next flow execution, resulting in cross‑tenant information disclosure and potential compromise of the target tenant’s processes.

The vulnerability affects deployments of Activepieces older than version 0.84.0 running in a shared worker environment where multiple tenants are hosted on the same infrastructure.

The CVSS score of 9.3 indicates critical severity. EPSS indicates a very low but nonzero likelihood of exploitation (EPSS 0.00238, <1%), and the vulnerability is not listed in CISA KEV. The attack vector is inferred to require authenticated access as a flow author and exploitation is likely confined to tenants sharing the same worker instance.