Activiti through 7.1.0.M6 contains an expression injection flaw where hash‑brace expressions that begin with #{} are not validated in process variables. These expressions are stored and later evaluated in the full Spring context when a mail task uses a variable‑backed body field, allowing the attacker to invoke arbitrary methods on application beans, effectively enabling execution of code within the application context.

All Activiti Process Engine builds up to and including 7.1.0.M6 are affected. Any deployment of Activiti 7.1.0.M6 or earlier that accepts untrusted process variable input for mail tasks exposes a vulnerability.

The CVSS score of 7.1 indicates a high severity impact. EPSS score < 1% indicates a very low but nonzero risk of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker or a compromised user submitting malicious variable content that is later processed during a mail task; once the expression is evaluated in the Spring context, the attacker can execute any bean method available to the application, achieving remote code execution within the application context.