Vulnerability in Valtimo Business Process Automation Platform Affects Data Security

CVE-2025-58059

What is CVE-2025-58059?

The Valtimo Business Process Automation platform has a vulnerability in versions prior to 12.16.0.RELEASE and from 13.0.0.RELEASE up until 13.1.2.RELEASE. Authorized administrators who can create and execute process definitions may exploit this vulnerability to gain unauthorized access to sensitive data and resources. This includes executing commands on the host application and extracting critical information from application properties and the host environment. For exploitation, an attacker must be logged in as an admin and possess knowledge of script execution via the Camunda/Operator engine. Upgrading to versions 12.16.0 or 13.1.2 is essential to alleviate these risks. For those who do not need scripting capabilities, disabling this function in ProcessEngineConfiguration is recommended, though it may cause unforeseen issues.

References