PT-2025-35893 · Vaadin · Vaadin 23.0.0+9

CVE-2025-9467 · Publicado 2025-09-04 · Atualizado 2025-09-04

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Vaadin versions 7.0.0 through 7.7.47 Vaadin versions 8.0.0 through 8.28.1 Vaadin versions 14.0.0 through 14.13.0 Vaadin versions 23.0.0 through 23.6.1 Vaadin versions 24.0.0 through 24.7.6

Description The Vaadin Upload component’s start listener validation can be bypassed when validating metadata for incoming uploads.

Recommendations Upgrade to Vaadin version 7.7.48 or newer. Upgrade to Vaadin version 8.28.2 or newer. Upgrade to Vaadin version 14.13.1 or newer. Upgrade to Vaadin version 23.6.2 or newer. Upgrade to Vaadin version 24.7.7 or newer.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-20

CWE-434

Identificadores relacionados

CVE-2025-9467

GHSA-94G8-XV23-7656

GHSA-9GFH-4FWJ-W3RJ

GHSA-C7V7-RQFM-F44J

Produtos afetados

Vaadin 14.0.0

Vaadin 14.13.0

Vaadin 23.0.0

Vaadin 23.6.1

Vaadin 24.0.0

Vaadin 24.7.6

Vaadin 7.0.0

Vaadin 7.7.47

Vaadin 8.0.0

Vaadin 8.28.1

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9467.json · Exploit
• https://github.com/vaadin/framework · Nota
• https://github.com/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj · Nota
• https://github.com/vaadin/platform · Nota
• https://github.com/vaadin/platform/security/advisories/GHSA-c7v7-rqfm-f44j · Nota
• https://github.com/vaadin/flow-components · Nota
• https://github.com/vaadin/flow-components/pull/7616 · Nota
• https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635 · Nota
• https://github.com/vaadin/flow-components/security/advisories/GHSA-94g8-xv23-7656 · Nota
• https://twitter.com/VulmonFeeds/status/1963607621778243824 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-c7v7-rqfm-f44j · Aviso do Fabricante
• https://repo.maven.apache.org/maven2 · Nota
• https://osv.dev/vulnerability/CVE-2025-9467 · Aviso do Fabricante
• https://vaadin.com/security/cve-2025-0000 · Nota
• https://twitter.com/CVEnew/status/1963504716106932696 · Publicação no Twitter