CVE-2026-12813 | activepieces up to 0.83.0 File URL file.ts handleUrlFile server-side request forgery

A vulnerability labeled as critical has been found in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/server/engine/src/lib/variables/processors/file.ts of the component File URL Handler. The manipulation results in server-side request forgery.

This vulnerability is identified as CVE-2026-12813. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.