CVE-2026-42555

{
  "id": "CVE-2026-42555",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T17:16:21.907",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0."
    },
    {
      "lang": "es",
      "value": "Valtimo es una plataforma de automatización de procesos de negocio de código abierto. com.ritense.valtimo:document desde 12.0.0 hasta antes de 12.32.0, com.ritense.valtimo:case desde 13.0.0 hasta antes de 13.23.0, y com.ritense.valtimo:contract desde 13.4.0 hasta antes de 13.23.0 evalúan expresiones de Spring Expression Language (SpEL) a partir de entradas proporcionadas por el usuario utilizando StandardEvaluationContext, lo que proporciona acceso sin restricciones a tipos y métodos de Java. Un usuario autenticado con el rol ADMIN puede lograr la ejecución remota de código y la exfiltración de credenciales. Esta vulnerabilidad está corregida en com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, y com.ritense.valtimo:contract 13.23.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "valtimo-platform",
          "product": "valtimo",
          "versions": [
            {
              "version": "< 13.23.0",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "com.ritense.valtimo",
          "product": "case",
          "versions": [
            {
              "version": ">= 13.0.0, < 13.23.0",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "com.ritense.valtimo",
          "product": "contract",
          "versions": [
            {
              "version": ">= 13.4.0, < 13.23.0",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "com.ritense.valtimo",
          "product": "document",
          "versions": [
            {
              "version": ">= 12.0.0, < 12.32.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T18:15:49.269576Z",
          "id": "CVE-2026-42555",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-j7j9-5253-f7vh",
      "source": "[email protected]"
    }
  ]
}