CVE Intelligence
Analysis AI-assisted

CVE-2026-42555: Valtimo: SpEL expression injection in document, case and contract modules

Valtimo versions in the document, case and contract modules evaluate user-supplied Spring Expression Language expressions with an unrestricted evaluation context, classified as CWE-94 code injection. The record states that an authenticated user with the ADMIN role can achieve remote code execution and credential exfiltration, and the NVD and CVE Program pages carry a CVSS 3.1 score of 9.1. No confirmed exploitation appears in the sources consulted, and the record lists a fixed version for document that conflicts with its affected range.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Valtimo is an open-source business process automation platform. According to the GitHub advisory referenced in the record, the document, case and contract modules evaluate Spring Expression Language (SpEL) expressions built from user-supplied input using a StandardEvaluationContext, which gives unrestricted access to Java types and methods. The record classifies the weakness as CWE-94 (Code Injection).

Impact

  • The record states that an authenticated user with the ADMIN role can achieve remote code execution and credential exfiltration.
  • The CVSS 3.1 score of 9.1 (critical) is provided by the CNA, GitHub Security Advisories, with network attack vector, low complexity, high privileges required, scope changed, and high confidentiality, integrity and availability impact.
  • Because the attacker must already hold the ADMIN role, the practical risk depends on how many accounts hold that role and how well they are protected.

Affected products and versions

  • com.ritense.valtimo:document from 12.0.0 to before 12.32.0.
  • com.ritense.valtimo:case from 13.0.0 to before 13.23.0.
  • com.ritense.valtimo:contract from 13.4.0 to before 13.23.0.
  • The structured affected list in the record is empty, so these ranges come only from the description text.
  • Fixed versions named in the description: com.ritense.valtimo:case 13.23.0 and com.ritense.valtimo:contract 13.23.0. The description also names com.ritense.valtimo:document 2.32.0, which does not fit the 12.x affected range; the correct fixed version for document should be verified in the advisory.

Exploitation status

  • The CISA KEV catalog entry in the record is not listed.
  • No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.00822 with a percentile of 0.56198, as recorded for the date 2026-10-13. EPSS estimates likelihood of exploitation and is not evidence of exploitation.

Remediation and mitigation

  • Upgrade the affected Valtimo modules to a fixed version listed in the GitHub advisory, and confirm the exact fixed version of the document module there.
  • Until patched, review which accounts hold the ADMIN role and remove unnecessary assignments, since the record requires that privilege.
  • Enforce strong authentication and monitor administrative accounts, and rotate credentials stored or reachable by the platform if compromise is suspected.
  • Review any custom expression handling in the platform and limit the data sources that feed into expression evaluation.

Detection guidance

  • Review application and audit logs for administrative actions on process, case and contract definitions that are unexpected or that come from unfamiliar accounts.
  • Monitor for unusual outbound connections or process activity originating from the Valtimo application server.
  • Track changes to configuration and definition data that include expression-like content, and correlate them with administrative sessions.

Limitations of the available information

  • The record's source status is Deferred, and the affected and fixes arrays are empty.
  • The record contains an inconsistency between the document fixed version (2.32.0) and the document affected range (12.x).
  • No vendor patch notes, proof-of-concept details or exploitation telemetry were available beyond the referenced advisory and CVE pages.
  • Whether deployments use the vulnerable expression path depends on configuration that the record does not describe.

Frequently asked questions

What is CVE-2026-42555?

It is a code injection weakness (CWE-94) in Valtimo modules document, case and contract, where user-supplied Spring Expression Language expressions are evaluated with unrestricted access to Java types and methods.

Who can exploit this vulnerability according to the record?

The record states that an authenticated user with the ADMIN role can achieve remote code execution and credential exfiltration.

Is this vulnerability known to be exploited?

The CISA KEV catalog entry in the record is not listed, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Upgrade affected Valtimo modules to a fixed version named in the GitHub advisory, and reduce and monitor the number of accounts holding the ADMIN role until the patch is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.