Skip to content
OpenAdvisories

Vendor

valtimo-platform

6 known vulnerabilities.

Products

valtimo 3 valtimo-backend-libraries 2 valtimo-frontend-libraries 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-42555

    Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users

    Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring …

    valtimo-platform com.ritense.valtimo valtimo contract Maven
  • Critical 9.1
    CVE-2025-58059

    Valtimo scripting engine can be used to gain access to sensitive data or resources

    Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. …

    valtimo-platform valtimo-backend-libraries com.ritense.valtimo:core Maven
  • Critical 9.8
    CVE-2024-34706

    @valtimo/components exposes access token to form.io

    Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this t…

    valtimo-platform valtimo-frontend-libraries @valtimo/components npm