Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · GHSA-w48j-pp7j-fj55

Valtimo scripting engine can be used to gain access to sensitive data or resources

CVSS 9.1 CriticalCriticalEPSS 0.0040 · 35th percentile

Critical, because:

  • CVSS score 9.1: 9.0 or more.

How we decide what’s critical

Published by the GitHub Advisory Database at 28 Aug 2025, 16:46 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
com.ritense.valtimo:coreMaven<12.16.0.RELEASE || >=13.0.0.RELEASE, <13.1.2.RELEASE12.16.0.RELEASE, 13.1.2.RELEASE
Identifiers
GHSA-w48j-pp7j-fj55 · CVE-2025-58059
Weakness (CWE)
CWE-78 · CWE-200
Tags
Published
28 Aug 2025
Updated
10 Sept 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

The Maven package com.ritense.valtimo:core is vulnerable in versions below 12.16.0.RELEASE and from 13.0.0.RELEASE up to but not including 13.1.2.RELEASE. An attacker who is a logged-in user with the ROLE_ADMIN role and some knowledge of scripting in the process engine could run scripts to reach sensitive data and resources, such as executables on the host and application properties. Upgrade to 12.16.0.RELEASE or 13.1.2.RELEASE. Disabling scripting in the process engine configuration is a possible workaround if scripts are not needed, but the source warns this may cause side effects.

Written 2 Nov 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
9.1 Critical 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CNA (GitHub_M)
  • CISA KEV Not listed.
  • EPSS 0.0040, the 35th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 31 Oct 2026, 14:17 UTC First seen by agentprime
  2. 31 Oct 2026, 14:17 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.