Vulnerabilidades de Valtimo-platform
CVEs publicadas que afetam produtos de Valtimo-platform: 3 registro(s), com severidade, exploração e correções.
CVE-2026-44516
Alta · 7.6
CWE-532 14/05/2026
Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.
CVE-2026-42555
Crítica · 9.1
CWE-94 14/05/2026
Valtimo: injeção de expressão SpEL nos módulos document, case e contract
Valtimo é uma plataforma open-source de automação de processos de negócio. com.ritense.valtimo:document de 12.0.0 até antes de 12.32.0, com.ritense.valtimo:case de 13.0.0 até antes de 13.23.0 e com.ritense.valtimo:contract de 13.4.0 até antes de 13.23.0 avaliam expressões Spring Expression Language (SpEL) provenientes de entrada fornecida pelo usuário usando StandardEvaluationContext, que oferece acesso irrestrito a tipos e métodos Java. Um usuário autenticado com a role ADMIN pode alcançar execução remota de código e exfiltração de credenciais. Esta vulnerabilidade é corrigida em com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0 e com.ritense.valtimo:contract 13.23.0.
CVE-2026-34164
Média · 4.9
CWE-532 16/04/2026
Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data (PII), citizen identifiers (BSN), and case details. This data is exposed to anyone with access to application logs or any Valtimo user with the admin role through the Admin UI logging module. This issue has been fixed in version 13.22.0. If developers are unable to upgrade immediately, they can restrict access to application logs and adjust the log level for com.ritense.inbox to WARN or higher in their application configuration as a workaround.