Activepieces’ git-sync feature, prior to version 0.82.0, clones a user-supplied Git repository into a temporary directory and then writes workflow, table, and connection data back to that clone. Two weaknesses allow those writes to escape the intended workspace: the clone operation does not disable Git’s symbolic‑link handling so an attacker who controls the repository can include symlinks that redirect the write paths, and user‑supplied identifiers such as the repository slug and the externalId of tables, flows, and connections are not validated against directory‑traversal sequences. This vulnerability corresponds to CWE‑22 (Path Traversal) and CWE‑59 (Improper Restriction of Accessible Resources by a Pathname). Consequently, an attacker who can author or push to a git‑sync repository can cause the Activepieces server to overwrite arbitrary files on the host filesystem, potentially tampering with configuration, causing a denial‑of‑service, or even achieving remote code execution if the overwritten file is executable or modifies privileged data.

The vulnerability affects installations of Activepieces (activepieces:activepieces) running any version earlier than 0.82.0. Users who are authorized to configure or push to a git-sync repository (holding the WRITE_PROJECT_RELEASE permission) could cause the server to overwrite files anywhere the Activepieces process user can write, which depending on host layout can be leveraged for tampering, denial of service, or remote code execution.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score of less than 1 % suggests a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control a remote Git repository that is cloned by the server and to have write permission on a project that uses git-sync. The attacker can then embed malicious symlinks or malicious identifiers to redirect writes to arbitrary paths, potentially overwriting critical files or creating executable payloads.