The vulnerability in Activiti up to version 7.1.0.M6 involves improper validation of hash-brace deferred expressions (#{...}) in process variables. Attackers can inject such expressions that bypass filtering and are evaluated in the full Spring context when a mail task uses variable-backed body fields. This enables attackers to invoke methods on application beans, potentially leading to unauthorized actions within the application environment.

Successful exploitation can lead to partial compromise of confidentiality by allowing attackers to invoke methods on application beans. The CVSS score of 7.1 (high) reflects the network attack vector with low complexity and low privileges required, no user interaction, and high confidentiality impact with limited integrity impact. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, avoid using untrusted input in process variables that may be evaluated in mail tasks or apply strict input validation and filtering as a temporary measure.