---
title: "CVE-2025-58059: Valtimo scripting engine can be used to gain access to sensitive data or resources"
url: https://erroneo.us/security/cve/CVE-2025-58059/
description: "CVE-2025-58059 (com.ritense.valtimo:core (Maven)): Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-08-28
date_modified: 2025-08-28
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-58059"
kev: false
cvss: 9.1
epss: 0.00405
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-58059: Valtimo scripting engine can be used to gain access to sensitive data or resources

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.4% , percentile 34: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 34% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes com.ritense.valtimo:core (Maven) < 12.16.0.RELEASE, fixed in 12.16.0.RELEASE ; com.ritense.valtimo:core (Maven) >= 13.0.0.RELEASE, < 13.1.2.RELEASE, fixed in 13.1.2.RELEASE . Check your lockfile, including transitive dependencies.

## What it is

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to: running executables on the application host, inspecting and extracting data from the host environment or application properties, spring beans (application context, database pooling). The following conditions have to be met in order to perform this attack: the user must be logged in, have the admin role, and must have some knowledge about running scripts via a the Camunda/Operator engine. Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade. If no scripting is needed in any of the processes, it could be possible to disable it altogether via the ProcessEngineConfiguration. However, this workaround could lead to unexpected side-effects.

## Affected packages

- Maven `com.ritense.valtimo:core` < 12.16.0.RELEASE → fixed: 12.16.0.RELEASE
- Maven `com.ritense.valtimo:core` >= 13.0.0.RELEASE, < 13.1.2.RELEASE → fixed: 13.1.2.RELEASE

## Affected products (CVE record)

- valtimo-platform valtimo-backend-libraries: < 12.16.0.RELEASE, >= 13.0.0.RELEASE, < 13.1.2.RELEASE

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.40% probability of exploitation activity in the next 30 days; percentile 34.

## Sources

- [GitHub Advisory GHSA-w48j-pp7j-fj55](https://github.com/advisories/GHSA-w48j-pp7j-fj55)
- [CVE.org record CVE-2025-58059](https://www.cve.org/CVERecord?id=CVE-2025-58059)
- [NVD entry CVE-2025-58059](https://nvd.nist.gov/vuln/detail/CVE-2025-58059)
- [github.com](https://github.com/valtimo-platform/valtimo-backend-libraries/security/advisories/GHSA-w48j-pp7j-fj55)
- [github.com](https://github.com/valtimo-platform/valtimo-backend-libraries/commit/45eb60b0b2df5964fb9917295d0dceb1fff8dd85)

---
Source page: https://erroneo.us/security/cve/CVE-2025-58059/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt