GHSA-c7v7-rqfm-f44j json
Vaadin Platform possible file bypass via upload validation on the server-side
published last yr. modified 2mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
### Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.
Patch / fix
- maven com.vaadin:vaadin 14.13.1, 23.6.2, 24.7.7
- github.com/vaadin/flow-components@bfe9e50 commit
- github.com/vaadin/flow-components#7616 pull request
Is GHSA-c7v7-rqfm-f44j in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.vaadin:vaadin | >=14.0.0, <14.13.1 >=23.0.0, <23.6.2 >=24.0.0, <24.7.7 |
14.13.1 23.6.2 24.7.7 |
Classification
References
-
github.com
/vaadin/flow-components/pull/7616
web
-
github.com
/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635
web
-
github.com
/vaadin/platform/security/advisories/GHSA-c7v7-rqfm-f44j
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-9467
advisory
-
github.com
/vaadin/platform
package
-
vaadin.com
/security/cve-2025-9467
web
Sources
- GitHub Advisory GHSA-c7v7-rqfm-f44j
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.