CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

🗓️ 16 Jul 2026 18:52:43Reported by GoogleType

osv

osv🔗 osv.dev👁 7 Views

CVE-2026-53535: Activepieces git-sync allowed arbitrary file writes via symlinks and path traversal.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-53535	16 Jul 202618:52	–	attackerkb
Circl	CVE-2026-53535	16 Jul 202620:05	–	circl
CVE	CVE-2026-53535	16 Jul 202618:52	–	cve
Cvelist	CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks	16 Jul 202618:52	–	cvelist
EUVD	EUVD-2026-45028	16 Jul 202618:52	–	euvd
NVD	CVE-2026-53535	16 Jul 202619:16	–	nvd
Positive Technologies	PT-2026-60558	16 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks	16 Jul 202618:52	–	vulnrichment

Source	Link
github	www.github.com/activepieces/activepieces/releases/tag/0.82.0
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53535.json
github	www.github.com/activepieces/activepieces/security/advisories/GHSA-qqcr-rg2x-97mm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-53535
github	www.github.com/activepieces/activepieces/commit/01bd4ef76fc1ad1bf7adc10c39ece4f624da6bf5
github	www.github.com/activepieces/activepieces/pull/12711

19 Jul 2026 03:31Current

6.3Medium risk

Vulners AI Score6.3

CVSS 45.9

EPSS0.00574

activepieces git sync symlinks path traversal arbitrary file write version 0.82.0