CVE-2026-42555 json
Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users
published 2026-05-06 6 mo ago modified 2026-10-25 14 d ago also GHSA-j7j9-5253-f7vh , EUVD-2026-30336
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0.
Patch / fix
- maven com.ritense.valtimo:document 12.32.0
- maven com.ritense.valtimo:case 13.23.0
- maven com.ritense.valtimo:contract 13.23.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.ritense.valtimo:document | >=12.0.0, <12.32.0 |
12.32.0 |
| maven | com.ritense.valtimo:case | >=13.0.0, <13.23.0 |
13.23.0 |
| maven | com.ritense.valtimo:contract | >=13.4.0, <13.23.0 |
13.23.0 |
Affected products
- valtimo-platform valtimo
- com.ritense.valtimo case
- com.ritense.valtimo contract
- com.ritense.valtimo document
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
Sources
- CVE List CVE-2026-42555
- GitHub Advisory GHSA-j7j9-5253-f7vh
- NVD CVE-2026-42555
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.