The vulnerability CVE-2026-12813 in activepieces up to version 0.83.0 is a server-side request forgery (SSRF) issue located in the handleUrlFile function of the File URL Handler component. This flaw allows remote attackers to manipulate the server into making unauthorized requests. The vulnerability is publicly disclosed with a medium severity CVSS 4.0 score of 5.3, indicating network attack vector, low attack complexity, no privileges required, and limited confidentiality, integrity, and availability impacts. No official fix or remediation guidance has been provided by the vendor, who has not responded to early contact attempts. The vulnerability affects all versions from 0.1 through 0.83.0 inclusive.

The SSRF vulnerability enables remote attackers to induce the server to make unintended requests, which can lead to information disclosure or interaction with internal systems. The CVSS score of 5.3 reflects a medium severity with limited impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing network-level controls to restrict outbound requests from the affected component and monitor for suspicious activity related to URL handling. Avoid exposing the vulnerable functionality to untrusted inputs until a patch is released.