PT-2025-35893 · Vaadin · Vaadin 14.13.0+9

Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-9467

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Vaadin versions 7.0.0 through 7.7.47 Vaadin versions 8.0.0 through 8.28.1 Vaadin versions 14.0.0 through 14.13.0 Vaadin versions 23.0.0 through 23.6.1 Vaadin versions 24.0.0 through 24.7.6

Description The Vaadin Upload component’s start listener validation can be bypassed when validating metadata for incoming uploads.

Recommendations Upgrade to Vaadin version 7.7.48 or newer. Upgrade to Vaadin version 8.28.2 or newer. Upgrade to Vaadin version 14.13.1 or newer. Upgrade to Vaadin version 23.6.2 or newer. Upgrade to Vaadin version 24.7.7 or newer.

Fix

Unrestricted File Upload

RCE

Weakness Enumeration

CWE-434

CWE-20

Related Identifiers

CVE-2025-9467

GHSA-94G8-XV23-7656

GHSA-9GFH-4FWJ-W3RJ

GHSA-C7V7-RQFM-F44J

Affected Products

Vaadin 14.0.0

Vaadin 14.13.0

Vaadin 23.0.0

Vaadin 23.6.1

Vaadin 24.0.0

Vaadin 24.7.6

Vaadin 7.0.0

Vaadin 7.7.47

Vaadin 8.0.0

Vaadin 8.28.1

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-9467 · Security Note
• https://osv.dev/vulnerability/GHSA-9gfh-4fwj-w3rj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c7v7-rqfm-f44j · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-94g8-xv23-7656 · Vendor Advisory
• https://github.com/vaadin/framework · Note
• https://github.com/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj · Note
• https://github.com/vaadin/platform/security/advisories/GHSA-c7v7-rqfm-f44j · Note
• https://github.com/vaadin/platform · Note
• https://github.com/vaadin/flow-components · Note
• https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635 · Note
• https://github.com/vaadin/flow-components/pull/7616 · Note
• https://github.com/vaadin/flow-components/security/advisories/GHSA-94g8-xv23-7656 · Note
• https://vaadin.com/security/cve-2025-0000 · Note
• https://twitter.com/VulmonFeeds/status/1963607621778243824 · Twitter Post
• https://twitter.com/CVEnew/status/1963504716106932696 · Twitter Post