CVE-2025-58059

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to: running executables on the application host, inspecting and extracting data from the host environment or application properties, spring beans (application context, database pooling). The following conditions have to be met in order to perform this attack: the user must be logged in, have the admin role, and must have some knowledge about running scripts via a the Camunda/Operator engine. Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade. If no scripting is needed in any of the processes, it could be possible to disable it altogether via the ProcessEngineConfiguration. However, this workaround could lead to unexpected side-effects.

• CWE-78
• CWE-200

• https://github.com/valtimo-platform/valtimo-backend-libraries/commit/45eb60b0b2df5964fb9917295d0dceb1fff8dd85
• https://github.com/valtimo-platform/valtimo-backend-libraries/security/advisories/GHSA-w48j-pp7j-fj55

Published

Aug 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58053Galette is a membership management web application for non p…9.8
• CVE-2025-58054Discourse is an open-source community discussion platform. V…5.4
• CVE-2025-58055Discourse is an open-source community discussion platform. I…4.3
• CVE-2025-58056Netty is an asynchronous event-driven network application fr…7.5
• CVE-2025-58057Netty is an asynchronous event-driven network application fr…7.5
• CVE-2025-58058xz is a pure golang package for reading and writing xz-compr…5.3
• CVE-2025-5806Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling r…8
• CVE-2025-58060OpenPrinting CUPS is an open source printing system for Linu…8
• CVE-2025-58061OpenEBS Local PV RawFile allows dynamic deployment of Statef…5.5
• CVE-2025-58062LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp de…7.3
• CVE-2025-58063CoreDNS is a DNS server that chains plugins. Starting in ver…7.1
• CVE-2025-58064CKEditor 5 is a modern JavaScript rich-text editor with an M…2.3