The vulnerability allows an authenticated Admin user to inject arbitrary Spring Expression Language (SpEL) code through user‑supplied input that is processed by the StandardEvaluationContext. This unrestricted evaluation enables execution of Java methods and classes, giving the attacker full control of the application, the ability to exfiltrate credentials, and the ability to perform other malicious actions at the level of the running process. This is a CWE-94: Improper Control of Generation of Code (Code Injection) vulnerability.

The affected components are com.ritense.valtimo:document versions 12.0.0 through 12.31.99, com.ritense.valtimo:case versions 13.0.0 through 13.22.99, and com.ritense.valtimo:contract versions 13.4.0 through 13.22.99. These are part of the Valtimo open‑source business process automation platform.

The CVSS score of 9.1 indicates a high‑severity impact. EPSS data is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires an authenticated user with the ADMIN role, the attack vector is likely limited to environments where such privileges exist, but the impact of exploitation remains severe.