Valtimo-platform vulnerabilities
We track 5 vulnerabilities in Valtimo-platform products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on May 14, 2026.
Latest Valtimo-platform vulnerabilities
- 7.6 High severity
valtimo: Insertion of Sensitive Information into Log File
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body,
- 9.1 Critical severity
valtimo: Improper Control of Generation of Code
Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring E
- 9.1 Critical severity
valtimo-backend-libraries: Improper Neutralization of Special Elements used in an OS Command
Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. T
- 8.3 High severity
valtimo-backend-libraries: Incorrect Authorization
Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or d
- 9.8 Critical severity
valtimo-frontend-libraries: Insertion of Sensitive Information into Log File
Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this to