Activiti through version 7.1.0.M6 contains an expression injection flaw where hash‑brace expressions that begin with #{} are not validated in process variables. These expressions are stored and later evaluated in the full Spring context when a mail task uses a variable‑backed body field, allowing the attacker to invoke arbitrary methods on application beans. The result is the ability to execute code, exfiltrate or alter data, or otherwise modify the application state.

All Activiti Process Engine builds up to and including 7.1.0.M6 are affected. Any deployment of Activiti 7.1.0.M6 or earlier that accepts untrusted process variable input for mail tasks exposes a vulnerability.

The CVSS score of 7.1 indicates a high severity impact. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker or a compromised user submitting malicious variable content that is later processed during a mail task; once the expression is evaluated in the Spring context, the attacker can execute any bean method available to the application, effectively achieving remote code execution within the application context.