PT-2025-36612 · Maven · Com.Vaadin:Vaadin-Server

Published 2025-09-04 · Updated 2025-09-04

OSV

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Green

Description

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.

Fix

Unrestricted File Upload

RCE

Weakness Enumeration

CWE-434

CWE-20

Related Identifiers

GHSA-9GFH-4FWJ-W3RJ

Affected Products

Com.Vaadin:Vaadin-Server

References · 7

• https://osv.dev/vulnerability/GHSA-9gfh-4fwj-w3rj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9467 · Security Note
• https://github.com/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj · Note
• https://github.com/vaadin/framework · Note
• https://github.com/vaadin/flow-components/pull/7616 · Note
• https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635 · Note
• https://vaadin.com/security/cve-2025-9467 · Note