CVE-2026-42555

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42555
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42555.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42555
Aliases
Published
2026-05-14T16:45:48.718Z
Modified
2026-07-15T22:54:11.890032Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users
Details

Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0.

Database specific 
{
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42555.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/valtimo-platform/valtimo

Affected ranges

Type
GIT
Repo
https://github.com/valtimo-platform/valtimo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7e621d39b22b1daf75a93582f4fc3abfd976c418
Introduced
7b9abf8a46fe50f57c0b87b1e185ba60582d6741
Fixed
7e621d39b22b1daf75a93582f4fc3abfd976c418
Introduced
aaaa47ea9c4a4a04e9d86b9e572065092beb3b1a
Fixed
7e621d39b22b1daf75a93582f4fc3abfd976c418
Introduced
caa62537ba50c3612ceaa00ae091c3cec86aafe0
Fixed
ff181ee70d8ce14c285f5553ece93dbf5da0c3ed
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "13.23.0"
        },
        {
            "introduced": "13.0.0"
        },
        {
            "introduced": "13.4.0"
        },
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.32.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

12.*
12.17.1
12.18.0
12.19.0
12.20.0
12.31.0
13.*
13.10.0
13.12.0
13.13.0
13.15.0
13.16.0
13.17.0
13.18.0
13.19.0
13.20.0
13.21.0
13.22.0
13.4.1
13.7.0
13.8.0
Other
post-bootstrap-monorepo
pre-bootstrap-monorepo

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/valtimo-platform/valtimo/commit/7e621d39b22b1daf75a93582f4fc3abfd976c418",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "302583967549828978066565598912958885572",
                "38170768098578040830655243006943986416",
                "11467688233623897616797500733356007898",
                "226413613593674141232890392625600263493",
                "288085301223733946941819828354247286361",
                "208197186312525565066757316307136560765",
                "91833600924898957222372623223159935624",
                "40035938183273106580735844400518684901",
                "109773745015306726081498220967050903771",
                "318683689713336195553082671802092534322",
                "282580306411442115898233559515374538884",
                "67295860365917971226330016146139983257"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-42555-50370727",
        "target": {
            "file": "backend/core/src/test/java/com/ritense/valtimo/service/util/FormUtilsTest.java"
        }
    },
    {
        "source": "https://github.com/valtimo-platform/valtimo/commit/7e621d39b22b1daf75a93582f4fc3abfd976c418",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "190612230982647505479217113770857562202",
            "length": 768.0
        },
        "deprecated": false,
        "id": "CVE-2026-42555-56bf467e",
        "target": {
            "function": "createTypedVariableMap",
            "file": "backend/core/src/main/java/com/ritense/valtimo/service/util/FormUtils.java"
        }
    },
    {
        "source": "https://github.com/valtimo-platform/valtimo/commit/7e621d39b22b1daf75a93582f4fc3abfd976c418",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "321776286788538910705210934390300321087",
            "length": 463.0
        },
        "deprecated": false,
        "id": "CVE-2026-42555-73018a77",
        "target": {
            "function": "createTypedVariableMap",
            "file": "backend/core/src/test/java/com/ritense/valtimo/service/util/FormUtilsTest.java"
        }
    },
    {
        "source": "https://github.com/valtimo-platform/valtimo/commit/7e621d39b22b1daf75a93582f4fc3abfd976c418",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "233804623881564518686265199328978939584",
                "161121858960774557069365874333669212020",
                "314671819350715946424049875575402093365",
                "291360492008789479111030604438413337784",
                "231744553577141651877286022720207784269",
                "216615661393481417418139385989534817901",
                "40913323996025852104410607368456933142"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-42555-aa53b2af",
        "target": {
            "file": "backend/core/src/main/java/com/ritense/valtimo/service/util/FormUtils.java"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T22:54:11Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42555.json"