CVE-2026-109432: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') in Camunda Camunda 7

Camunda 7 versions 7.24.0 prior to 7.24.14 and 7.23.0 prior to 7.23.17 contain an expression injection vulnerability due to improper validation in AdhocQueryValidator.validate(). The validator fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, enabling authenticated attackers to bypass the enableExpressionsInAdhocQueries restriction. By supplying a malicious JUEL expression such as dueAfterExpression inside an orQueries entry, attackers can leverage Java reflection to invoke java.lang.Runtime.exec, resulting in arbitrary operating system command execution with the privileges of the engine service user.

Successful exploitation allows authenticated users to execute arbitrary operating system commands on the server running Camunda 7, potentially leading to full system compromise under the engine service user's privileges. This can result in unauthorized control over the affected system and data.

A fix is available in Camunda 7.24.14 and 7.23.17. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory content was provided, but the affected versions and fixed versions are clearly stated.