Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-9467

Good to know:

icon

Date: September 4, 2025

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.47 Vaadin 8.0.0 - 8.28.1 Vaadin 14.0.0 - 14.13.0 Vaadin 23.0.0 - 23.6.1 Vaadin 24.0.0 - 24.7.6 Mitigation Upgrade to 7.7.48 Upgrade to 8.28.2 Upgrade to 14.13.1 Upgrade to 23.6.2 Upgrade to 24.7.7 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24 version. Artifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.47 ≥7.7.48 com.vaadin:vaadin-server 8.0.0 - 8.28.1 ≥8.28.2 com.vaadin:vaadin 14.0.0 - 14.13.0 ≥14.13.1 com.vaadin:vaadin23.0.0 - 23.6.1 ≥23.6.2 com.vaadin:vaadin24.0.0 - 24.7.6 ≥24.7.7com.vaadin:vaadin-upload-flow 2.0.0 - 14.13.0 ≥14.13.1 com.vaadin:vaadin-upload-flow 23.0.0 - 23.6.1 ≥23.6.2 com.vaadin:vaadin-upload-flow 24.0.0 - 24.7.6 ≥24.7.7

Severity Score

Related Resources (8)

https://vaadin.com/security/cve-2025-0000
https://github.com/vaadin/flow-components/pull/7616
https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635
https://github.com/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj
https://nvd.nist.gov/vuln/detail/CVE-2025-9467
https://vaadin.com/security/cve-2025-9467
https://github.com/vaadin/framework
https://www.mend.io/vulnerability-database/CVE-2025-9467

Severity Score

Weakness Type (CWE)

Improper Input Validation

CWE-20

Unrestricted Upload of File with Dangerous Type

CWE-434

Top Fix

icon

Upgrade Version

Upgrade to version com.vaadin:vaadin-server:7.7.48;com.vaadin:vaadin-server:8.28.2;com.vaadin:vaadin-upload-flow:24.7.7;com.vaadin:vaadin-upload-flow:23.6.2;com.vaadin:vaadin-upload-flow:14.13.1;https://github.com/vaadin/flow-components.git - 24.7.7;https://github.com/vaadin/flow-components.git - 23.6.2;https://github.com/vaadin/flow-components.git - 14.13.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us