PT-2025-36612 · Maven · Com.Vaadin:Vaadin-Server

Publicado 2025-09-04 · Atualizado 2025-09-04

OSV

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Green

Description

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.

Correção

Unrestricted File Upload

RCE

Enumeração de Fraquezas

CWE-434

CWE-20

Identificadores relacionados

GHSA-9GFH-4FWJ-W3RJ

Produtos afetados

Com.Vaadin:Vaadin-Server

Referências · 7

• https://github.com/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj · Nota
• https://github.com/vaadin/framework · Nota
• https://github.com/vaadin/flow-components/pull/7616 · Nota
• https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635 · Nota
• https://osv.dev/vulnerability/GHSA-9gfh-4fwj-w3rj · Aviso do Fabricante
• https://vaadin.com/security/cve-2025-9467 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-9467 · Nota de Segurança