Alfresco Activiti EUVD-2026-109554

Requires an authenticated session with at least low privileges (CVSS 4.0 PR:L) able to supply input that is routed to JuelScriptEngine.eval for JUEL/script evaluation; this is the concrete prerequisite, though the specific product feature or field feeding that eval call is not described in the available sources. Affects Alfresco Activiti up to and including 7.21.0-rc.692. Limiting factors: valid credentials are mandatory (not remote-unauthenticated), and because the vendor did not respond there is no published fixed version or vendor mitigation; the realistic impact also depends on whether the reachable eval permits arbitrary Java invocation, which the sources do not confirm.

All quantitative signals are modest: the only supplied score is a CVSS 4.0 base of 5.3 (medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N and low impacts (VC:L/VI:L/VA:L, no subsequent-system impact). PR:L means exploitation is authenticated, which materially limits the exposed population. No EPSS probability, no CISA KEV listing, and no confirmed working exploit were provided - the only references are VulDB catalog/CTI pages, so this is best treated as 'no public exploit identified at time of analysis.' The vuln.today decision label is this_month, indicating a moderate, non-emergency priority rather than act_now. There is a real tension in the data to flag explicitly: the issue is tagged RCE / Code Injection and classified CWE-94 (code injection through a script-engine eval), which normally implies code execution, yet VulDB's own 4.0 vector rates every impact as only Low - this discrepancy should be verified rather than taken at face value. Compounding the uncertainty, the vendor was contacted but did not respond, so there is no vendor advisory, no vendor severity, and no published fix; the flaw is effectively unresolved. Net: a moderate-severity, authenticated, remotely reachable code-injection issue that warrants scheduled remediation, not crisis response - but the impact magnitude is unsettled and the trigger is not described in the available sources.

An attacker holding a low-privilege authenticated account on an Alfresco Activiti instance (<= 7.21.0-rc.692) supplies crafted input that is passed to JuelScriptEngine.eval, where it is evaluated as a JUEL/script expression, achieving code injection over the network. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates low attack complexity and no user interaction once valid credentials are held. No confirmed working exploit is available - only VulDB reference pages exist - and the exact feature or field that reaches the vulnerable eval call is not described in the available sources.