CVE-2025-9467 json
Possibility to bypass file upload validation on the server-side
published 2025-09-04 14 mo ago modified 2026-10-18 21 d ago also GHSA-9gfh-4fwj-w3rj , EUVD-2025-26701
- cvss
- 5.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 7.0.0 - 7.7.47 Vaadin 8.0.0 - 8.28.1 Vaadin 14.0.0 - 14.13.0 Vaadin 23.0.0 - 23.6.1 Vaadin 24.0.0 - 24.7.6
Mitigation Upgrade to 7.7.48 Upgrade to 8.28.2 Upgrade to 14.13.1 Upgrade to 23.6.2 Upgrade to 24.7.7 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24 version.
Artifacts Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.47 ≥7.7.48 com.vaadin:vaadin-server 8.0.0 - 8.28.1 ≥8.28.2 com.vaadin:vaadin 14.0.0 - 14.13.0 ≥14.13.1 com.vaadin:vaadin23.0.0 - 23.6.1 ≥23.6.2 com.vaadin:vaadin24.0.0 - 24.7.6 ≥24.7.7com.vaadin:vaadin-upload-flow 2.0.0 - 14.13.0 ≥14.13.1 com.vaadin:vaadin-upload-flow 23.0.0 - 23.6.1 ≥23.6.2 com.vaadin:vaadin-upload-flow 24.0.0 - 24.7.6 ≥24.7.7
Patch / fix
- maven com.vaadin:vaadin-server 7.7.48, 8.28.2
- github.com/vaadin/flow-components@bfe9e50 commit
- github.com/vaadin/flow-components#7616 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Green |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.vaadin:vaadin-server | >=7.0.0, <7.7.48 >=8.0.0, <8.28.2 |
7.7.48 8.28.2 |
Affected products
- vaadin vaadin
- vaadin framework
- vaadin vaadin-upload-flow
Classification
References
-
github.com
/vaadin/flow-components/pull/7616
web
-
github.com
/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635
web
-
vaadin.com
/security/cve-2025-9467
web
-
github.com
/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-9467
advisory
-
github.com
/vaadin/framework
package
Sources
- CVE List CVE-2025-9467
- GitHub Advisory GHSA-9gfh-4fwj-w3rj
- NVD CVE-2025-9467
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.