{"id":"CVE-2025-58059","aliases":["GHSA-w48j-pp7j-fj55"],"url":"https://o3.security/vulnerability/CVE-2025-58059","summary":"Valtimo scripting engine can be used to gain access to sensitive data or resources","details":"### Impact\nAny admin that can create or modify and execute process-definitions could gain access to sensitive data or resources.\n\nThis includes but is not limited to:\n- Running executables on the application host\n- Inspecting and extracting data from the host environment or application properties\n- Spring beans (application context, database pooling)\n\n### Attack requirements\nThe following conditions have to be met in order to perform this attack:\n- The user must be logged in\n- The user must have the admin role (ROLE_ADMIN), which is required to change process definitions\n- The user must have some knowledge about running scripts via a the Camunda/Operator engine\n\n### Patches\nVersion 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade.\n\n### Workarounds\nIf no scripting is needed in any of the processes, it could be possible to disable it altogether via the `ProcessEngineConfiguration`:\n```\n@Component\nclass NoScriptEnginePlugin : ProcessEnginePlugin {\n    override fun preInit(processEngineConfiguration: ProcessEngineConfigurationImpl) {}\n\n    override fun postInit(processEngineConfiguration: ProcessEngineConfigurationImpl) {\n        processEngineConfiguration.scriptEngineResolver = null\n    }\n\n    override fun postProcessEngineBuild(processEngine: ProcessEngine) {}\n}\n```\nWarning: this workaround could lead to unexpected side-effects. Please test thoroughly.\n\n### References\n- Valtimo 12 and lower: [Camunda Scripting](https://docs.camunda.org/manual/latest/user-guide/process-engine/scripting/#custom-scriptengineresolver)\n- Valtimo 13 and higher: [Operaton Scripting](https://docs.operaton.org/docs/documentation/user-guide/process-engine/scripting)","published":"2025-08-28T17:50:50.585Z","modified":"2026-08-12T03:51:09.948937143Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.ritense.valtimo:core","fixedVersion":"12.16.0.RELEASE"},{"ecosystem":"Maven","name":"com.ritense.valtimo:core","fixedVersion":"13.1.2.RELEASE"}],"fix":{"url":"https://github.com/valtimo-platform/valtimo-backend-libraries/commit/45eb60b0b2df5964fb9917295d0dceb1fff8dd85","label":"valtimo-platform/valtimo-backend-libraries@45eb60b"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58059.json"},{"type":"ADVISORY","url":"https://github.com/valtimo-platform/valtimo-backend-libraries/security/advisories/GHSA-w48j-pp7j-fj55"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58059"},{"type":"FIX","url":"https://github.com/valtimo-platform/valtimo-backend-libraries/commit/45eb60b0b2df5964fb9917295d0dceb1fff8dd85"},{"type":"PACKAGE","url":"https://github.com/valtimo-platform/valtimo-backend-libraries"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:09.948937143Z"}}