Security Digest · Vulnerability record
CVE-2025-58059: Valtimo scripting engine can be used to gain access to sensitive data or resources
Valtimo is a platform for Business Process Automation.
CVSS 9.1 Critical EPSS 0.4% · p34
Should you act?
Critical, preconditions apply
Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.4%, percentile 34: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 34% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes
com.ritense.valtimo:core(Maven) < 12.16.0.RELEASE, fixed in 12.16.0.RELEASE;com.ritense.valtimo:core(Maven) >= 13.0.0.RELEASE, < 13.1.2.RELEASE, fixed in 13.1.2.RELEASE. Check your lockfile, including transitive dependencies.
What it is
Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to: running executables on the application host, inspecting and extracting data from the host environment or application properties, spring beans (application context, database pooling). The following conditions have to be met in order to perform this attack: the user must be logged in, have the admin role, and must have some knowledge about running scripts via a the Camunda/Operator engine. Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade. If no scripting is needed in any of the processes, it could be possible to disable it altogether via the ProcessEngineConfiguration. However, this workaround could lead to unexpected side-effects.
From the GitHub advisory
Impact Any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources.
This includes but is not limited to: - Running executables on the application host - Inspecting and extracting data from the host environment or application properties - Spring beans (application context, database pooling)
Attack requirements The following conditions have to be met in order to perform this attack: - The user must be logged in - The user must have the admin role (ROLEADMIN), which is required to change process definitions - The user must have some knowledge about running scripts via a the Camunda/Operator engine
Patches Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade.
Workarounds If no scripting is needed in any of the processes, it could be possible to disable it altogether via the ProcessEngineConfiguration:
Weakness type: CWE-78, CWE-200.
Product: com.ritense.valtimo:core (Maven) · Assigned by: GitHub_M · Published: 2025-08-28
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Maven | com.ritense.valtimo:core | < 12.16.0.RELEASE | 12.16.0.RELEASE |
| Maven | com.ritense.valtimo:core | >= 13.0.0.RELEASE, < 13.1.2.RELEASE | 13.1.2.RELEASE |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| valtimo-platform | valtimo-backend-libraries | < 12.16.0.RELEASE, >= 13.0.0.RELEASE, < 13.1.2.RELEASE |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: high (admin)
- User interaction: none
- Scope: changed (can affect other components)
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- FIRST EPSS (model of 2026-10-21): 0.40% probability of exploitation activity in the next 30 days; percentile 34.
Timeline
- — CVE record last updated
- — CVE record published by GitHub_M
- — GitHub-reviewed advisory GHSA-w48j-pp7j-fj55 published (critical)
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-w48j-pp7j-fj55 github.com
- CVE.org record CVE-2025-58059 cve.org
- NVD entry CVE-2025-58059 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com
- github.com github.com