CVE-2026-42555

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42555", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-28T16:56:50.191Z", "datePublished": "2026-05-14T16:45:48.718Z", "dateUpdated": "2026-05-14T18:27:58.801Z"}, "containers": {"cna": {"title": "Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-j7j9-5253-f7vh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-j7j9-5253-f7vh"}], "affected": [{"vendor": "valtimo-platform", "product": "valtimo", "versions": [{"version": "< 13.23.0", "status": "affected"}]}, {"vendor": "com.ritense.valtimo", "product": "case", "versions": [{"version": ">= 13.0.0, < 13.23.0", "status": "affected"}]}, {"vendor": "com.ritense.valtimo", "product": "contract", "versions": [{"version": ">= 13.4.0, < 13.23.0", "status": "affected"}]}, {"vendor": "com.ritense.valtimo", "product": "document", "versions": [{"version": ">= 12.0.0, < 12.32.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T16:45:48.718Z"}, "descriptions": [{"lang": "en", "value": "Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0."}], "source": {"advisory": "GHSA-j7j9-5253-f7vh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T18:15:49.269576Z", "id": "CVE-2026-42555", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T18:27:58.801Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42555", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T18:15:49.269576Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T18:23:14.660Z"}}], "cna": {"title": "Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users", "source": {"advisory": "GHSA-j7j9-5253-f7vh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "valtimo-platform", "product": "valtimo", "versions": [{"status": "affected", "version": "< 13.23.0"}]}, {"vendor": "com.ritense.valtimo", "product": "case", "versions": [{"status": "affected", "version": ">= 13.0.0, < 13.23.0"}]}, {"vendor": "com.ritense.valtimo", "product": "contract", "versions": [{"status": "affected", "version": ">= 13.4.0, < 13.23.0"}]}, {"vendor": "com.ritense.valtimo", "product": "document", "versions": [{"status": "affected", "version": ">= 12.0.0, < 12.32.0"}]}], "references": [{"url": "https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-j7j9-5253-f7vh", "name": "https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-j7j9-5253-f7vh", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T16:45:48.718Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42555", "state": "PUBLISHED", "dateUpdated": "2026-05-14T18:27:58.801Z", "dateReserved": "2026-04-28T16:56:50.191Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-14T16:45:48.718Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "valtimo", "vendor": "valtimo-platform", "versions": [{"status": "affected", "version": "< 13.23.0"}]}, {"product": "case", "vendor": "com.ritense.valtimo", "versions": [{"status": "affected", "version": ">= 13.0.0, < 13.23.0"}]}, {"product": "contract", "vendor": "com.ritense.valtimo", "versions": [{"status": "affected", "version": ">= 13.4.0, < 13.23.0"}]}, {"product": "document", "vendor": "com.ritense.valtimo", "versions": [{"status": "affected", "version": ">= 12.0.0, < 12.32.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0."}, {"lang": "es", "value": "Valtimo es una plataforma de automatizaci\u00f3n de procesos de negocio de c\u00f3digo abierto. com.ritense.valtimo:document desde 12.0.0 hasta antes de 12.32.0, com.ritense.valtimo:case desde 13.0.0 hasta antes de 13.23.0, y com.ritense.valtimo:contract desde 13.4.0 hasta antes de 13.23.0 eval\u00faan expresiones de Spring Expression Language (SpEL) a partir de entradas proporcionadas por el usuario utilizando StandardEvaluationContext, lo que proporciona acceso sin restricciones a tipos y m\u00e9todos de Java. Un usuario autenticado con el rol ADMIN puede lograr la ejecuci\u00f3n remota de c\u00f3digo y la exfiltraci\u00f3n de credenciales. Esta vulnerabilidad est\u00e1 corregida en com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, y com.ritense.valtimo:contract 13.23.0."}], "id": "CVE-2026-42555", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42555", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T18:15:49.269576Z", "version": "2.0.3"}}]}, "published": "2026-05-14T17:16:21.907", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-j7j9-5253-f7vh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.23.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "case", "source": "cna", "vendor": "com.ritense.valtimo"}, "product": "case", "vendor": "com.ritense.valtimo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.4.0,13.23.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "contract", "source": "cna", "vendor": "com.ritense.valtimo"}, "product": "contract", "vendor": "com.ritense.valtimo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.32.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "document", "source": "cna", "vendor": "com.ritense.valtimo"}, "product": "document", "vendor": "com.ritense.valtimo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,13.23.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "valtimo", "source": "cna", "vendor": "valtimo-platform"}, "product": "valtimo", "vendor": "valtimo-platform"}], "created": "2026-05-14T19:00:13.390594+00:00", "updated": "2026-05-17T17:09:09.932342+00:00", "vendors": ["com.ritense.valtimo", "com.ritense.valtimo$PRODUCT$case", "com.ritense.valtimo$PRODUCT$contract", "com.ritense.valtimo$PRODUCT$document", "valtimo-platform", "valtimo-platform$PRODUCT$valtimo"]}