CVE-2025-58059

Valtimo scripting engine vulnerability (CVE-2025-58059) affects Valtimo BPM platform prior to 12.16.0.RELEASE and 13.0.0.RELEASE to before 13.1.2.RELEASE. An admin who can create/modify and execute process definitions could access sensitive data or resources on the host (e.g., executing host exec...

CVE-2025-58059 Valtimo scripting engine can be used to gain access to sensitive data or resources

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to:...

com.ritense.valtimo:besluit (11.0.0.release), com.ritense.valtimo:besluiten-api (11.0.0.release) +29 more potentially affected by CVE-2025-58059 via com.ritense.valtimo:core (11.0.0.release)

com.ritense.valtimo:core MAVEN version 11.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on com.ritense.valtimo:core and may be impacted: - com.ritense.valtimo:besluit 11.0.0.release - com.ritense.valtimo:besluiten-api 11.0.0.release -...

PT-2025-35122

Name of the Vulnerable Software and Affected Versions Valtimo versions prior to 12.16.0 Valtimo versions 13.0.0 through 13.1.1 Description Valtimo is a platform for Business Process Automation. Administrators with the ability to create, modify, and execute process definitions could gain access to...

Valtimo security vulnerabilities

Valtimo is a low-code platform for business process automation open-sourced by Valtimo in the Netherlands. A security vulnerability exists in Valtimo versions prior to 12.16.0.RELEASE and 13.1.2.RELEASE, which stems from the possibility that an administrator may access sensitive data or resources...

CVE-2025-58059: Improper Neutralization of Special Elements used in an OS Command

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to:...

CVE-2025-48881

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

CVE-2025-48881

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

CVE-2025-48881

CVE-2025-48881 pertains to the valtimo-backend-libraries component. Vulnerable versions (11.0.0.RELEASE–11.3.3.RELEASE and 12.0.0.RELEASE–12.12.0.RELEASE) allow unauthorised users to list, view, edit, create or delete objects for which an object-management configuration exists; exposure of object...

CVE-2025-48881

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

Valtimo-backend-libraries security vulnerabilities

valtimo-backend-libraries is an open source business process automation platform from Valtimo. A security vulnerability exists in valtimo-backend-libraries that originates from an unauthorized user being able to list, view, edit, create, or delete objects...

CVE-2025-48881: Incorrect Authorization

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

GHSA-965R-9CG9-G42P Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Impact All objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. Attack...

PT-2025-23221 · Valtimo · Valtimo

Name of the Vulnerable Software and Affected Versions: Valtimo versions 11.0.0.RELEASE through 11.3.3.RELEASE Valtimo versions 12.0.0.RELEASE through 12.12.0.RELEASE Description: The issue allows unauthorized users to list, view, edit, create, or delete objects for which an object-management...

CVE-2024-34706

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

CVE-2024-34706

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

CVE-2024-34706: Insertion of Sensitive Information into Log File

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...