TI-2025-35902 Aliases CVE-2025-58059 GHSA-w48j-pp7j-fj55

Valtimo scripting engine can be used to gain access to sensitive data or resources

MEDIUM 41CWE-200Published 2025-08-28 · Updated 2025-08-28

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-78.

Summary

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to: running executables on the application host, inspecting and extracting data from the host environment or application properties, spring beans (application context, database pooling). The following conditions have to be met in order to perform this attack: the user must be logged in, have the admin role, and must have some knowledge about running scripts via a the Camunda/Operator engine. Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade. If no scripting is needed in any of the processes, it could be possible to disable it altogether via the ProcessEngineConfiguration. However, this workaround could lead to unexpected side-effects.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00405 35th percentileScored 2026-11-07

Fix Fixed valtimo-backend-libraries (valtimo-platform): 12.16.0.RELEASE, 13.1.2.RELEASEcom.ritense.valtimo:core (Maven): 12.16.0.RELEASE, 13.1.2.RELEASE

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
valtimo-platform	valtimo-backend-libraries	before 12.16.0.RELEASE; 13.0.0.RELEASE to before 13.1.2.RELEASE	12.16.0.RELEASE, 13.1.2.RELEASE	Patch available	CNA
—	com.ritense.valtimo:core (Maven)	before 12.16.0.RELEASE	12.16.0.RELEASE	Patch available	GHSA-w48j-pp7j-fj55
—	com.ritense.valtimo:core (Maven)	13.0.0.RELEASE to before 13.1.2.RELEASE	13.1.2.RELEASE	Patch available	GHSA-w48j-pp7j-fj55

valtimo-backend-libraries Vendorvaltimo-platform Affected before 12.16.0.RELEASE; 13.0.0.RELEASE to before 13.1.2.RELEASE Fixed in 12.16.0.RELEASE, 13.1.2.RELEASE Patch available CNA
com.ritense.valtimo:core (Maven) Vendor— Affected before 12.16.0.RELEASE Fixed in 12.16.0.RELEASE Patch available GHSA-w48j-pp7j-fj55
com.ritense.valtimo:core (Maven) Vendor— Affected 13.0.0.RELEASE to before 13.1.2.RELEASE Fixed in 13.1.2.RELEASE Patch available GHSA-w48j-pp7j-fj55

Remediation

Fix · CNA valtimo-backend-libraries (valtimo-platform) Fixed in 12.16.0.RELEASE, 13.1.2.RELEASE
Fix · GHSA-w48j-pp7j-fj55 com.ritense.valtimo:core (Maven) Fixed in 12.16.0.RELEASE Advisory →
Fix · GHSA-w48j-pp7j-fj55 com.ritense.valtimo:core (Maven) Fixed in 13.1.2.RELEASE Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-58059
2026-10-03 Alias added: GHSA-w48j-pp7j-fj55

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-58059

Other 3

TI-2024-23003 @valtimo/components exposes access token to form.io CVSS 3.1CRITICAL 9.8
TI-2026-30835 Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users CVSS 3.1CRITICAL 9.1
TI-2025-31031 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users CVSS 3.1HIGH 8.3
TI-2026-32446 Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer CVSS 3.1HIGH 7.6
TI-2026-26464 Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences