Read the docs
TI-2026-30835 Aliases CVE-2026-42555GHSA-j7j9-5253-f7vh

Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users

Priority MEDIUM 42CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00576 47th percentileScored 2026-11-07
Fix Fixed valtimo (valtimo-platform): 13.23.0case (com.ritense.valtimo): 13.23.0+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
valtimo-platformvaltimobefore 13.23.013.23.0Patch availableCNA
com.ritense.valtimocase13.0.0 to before 13.23.013.23.0Patch availableCNA
com.ritense.valtimocontract13.4.0 to before 13.23.013.23.0Patch availableCNA
com.ritense.valtimodocument12.0.0 to before 12.32.012.32.0Patch availableCNA
—com.ritense.valtimo:document (Maven)12.0.0 to before 12.32.012.32.0Patch availableGHSA-j7j9-5253-f7vh
—com.ritense.valtimo:case (Maven)13.0.0 to before 13.23.013.23.0Patch availableGHSA-j7j9-5253-f7vh
—com.ritense.valtimo:contract (Maven)13.4.0 to before 13.23.013.23.0Patch availableGHSA-j7j9-5253-f7vh
  • valtimo Vendorvaltimo-platform Affected before 13.23.0 Fixed in 13.23.0 Patch available CNA
  • case Vendorcom.ritense.valtimo Affected 13.0.0 to before 13.23.0 Fixed in 13.23.0 Patch available CNA
  • contract Vendorcom.ritense.valtimo Affected 13.4.0 to before 13.23.0 Fixed in 13.23.0 Patch available CNA
  • document Vendorcom.ritense.valtimo Affected 12.0.0 to before 12.32.0 Fixed in 12.32.0 Patch available CNA
  • com.ritense.valtimo:document (Maven) Vendor— Affected 12.0.0 to before 12.32.0 Fixed in 12.32.0 Patch available GHSA-j7j9-5253-f7vh
  • com.ritense.valtimo:case (Maven) Vendor— Affected 13.0.0 to before 13.23.0 Fixed in 13.23.0 Patch available GHSA-j7j9-5253-f7vh
  • com.ritense.valtimo:contract (Maven) Vendor— Affected 13.4.0 to before 13.23.0 Fixed in 13.23.0 Patch available GHSA-j7j9-5253-f7vh

Remediation

  • Fix · CNA valtimo (valtimo-platform) Fixed in 13.23.0
  • Fix · CNA case (com.ritense.valtimo) Fixed in 13.23.0
  • Fix · CNA contract (com.ritense.valtimo) Fixed in 13.23.0
  • Fix · CNA document (com.ritense.valtimo) Fixed in 12.32.0
  • Fix · GHSA-j7j9-5253-f7vh com.ritense.valtimo:document (Maven) Fixed in 12.32.0 Advisory →
  • Fix · GHSA-j7j9-5253-f7vh com.ritense.valtimo:case (Maven) Fixed in 13.23.0 Advisory →
  • Fix · GHSA-j7j9-5253-f7vh com.ritense.valtimo:contract (Maven) Fixed in 13.23.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42555
  2. 2026-10-03 Alias added: GHSA-j7j9-5253-f7vh
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

Other 2

  • TI-2024-23003 @valtimo/components exposes access token to form.io CVSS 3.1CRITICAL 9.8
  • TI-2025-35902 Valtimo scripting engine can be used to gain access to sensitive data or resources CVSS 3.1CRITICAL 9.1
  • TI-2025-31031 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users CVSS 3.1HIGH 8.3
  • TI-2026-32446 Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer CVSS 3.1HIGH 7.6
  • TI-2026-26464 Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences