CVE-2025-58059: 
Java vulnerability analysis and mitigation

CVE-2025-58059 affects Valtimo, a platform for Business Process Automation, in versions before 12.16.0.RELEASE and from 13.0.0.RELEASE to before 13.1.2.RELEASE. The vulnerability was disclosed on August 28, 2025, and patches were released in versions 12.16.0 and 13.1.2 (GitHub Advisory).

The vulnerability allows administrators with process-definition modification privileges to exploit the scripting engine to access sensitive data and resources. The vulnerability has received a CVSS v3.1 base score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. It is classified under CWE-78 (OS Command Injection) and CWE-200 (Exposure of Sensitive Information) (GitHub Advisory).

The vulnerability can lead to unauthorized access to sensitive data and resources, including the ability to run executables on the application host, inspect and extract data from the host environment or application properties, and access Spring beans (application context, database pooling) (GitHub Advisory).

The vulnerability has been patched in versions 12.16.0 and 13.1.2. Users are strongly advised to upgrade to these versions. A temporary workaround involves disabling scripting altogether via the ProcessEngineConfiguration, though this may cause unexpected side-effects and requires thorough testing (GitHub Advisory).