Skip to content
Fencer Vulns
critical 9.1

CVE-2025-58059 json

Valtimo scripting engine can be used to gain access to sensitive data or resources

published 2025-08-28 14 mo ago modified 2026-09-10 1 mo ago also GHSA-w48j-pp7j-fj55 , EUVD-2025-26128

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to: running executables on the application host, inspecting and extracting data from the host environment or application properties, spring beans (application context, database pooling). The following conditions have to be met in order to perform this attack: the user must be logged in, have the admin role, and must have some knowledge about running scripts via a the Camunda/Operator engine. Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade. If no scripting is needed in any of the processes, it could be possible to disable it altogether via the ProcessEngineConfiguration. However, this workaround could lead to unexpected side-effects.

Patch / fix

  • maven com.ritense.valtimo:core 12.16.0.RELEASE, 13.1.2.RELEASE

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
14 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven com.ritense.valtimo:core
<12.16.0.RELEASE
>=13.0.0.RELEASE, <13.1.2.RELEASE
12.16.0.RELEASE
13.1.2.RELEASE

Affected products

  • valtimo-platform valtimo-backend-libraries

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.