Vulnerability DatabaseCVE-2025-9467
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-9467
September 04, 2025
When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.47 Vaadin 8.0.0 - 8.28.1 Vaadin 14.0.0 - 14.13.0 Vaadin 23.0.0 - 23.6.1 Vaadin 24.0.0 - 24.7.6 Mitigation Upgrade to 7.7.48 Upgrade to 8.28.2 Upgrade to 14.13.1 Upgrade to 23.6.2 Upgrade to 24.7.7 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24 version. Artifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.47 ≥7.7.48 com.vaadin:vaadin-server 8.0.0 - 8.28.1 ≥8.28.2 com.vaadin:vaadin 14.0.0 - 14.13.0 ≥14.13.1 com.vaadin:vaadin23.0.0 - 23.6.1 ≥23.6.2 com.vaadin:vaadin24.0.0 - 24.7.6 ≥24.7.7com.vaadin:vaadin-upload-flow 2.0.0 - 14.13.0 ≥14.13.1 com.vaadin:vaadin-upload-flow 23.0.0 - 23.6.1 ≥23.6.2 com.vaadin:vaadin-upload-flow 24.0.0 - 24.7.6 ≥24.7.7
Affected Packages
https://github.com/vaadin/flow-components.git (GITHUB):
Affected version(s) >=14.4.0 <14.13.1
Fix Suggestion:
Update to version 14.13.1
https://github.com/vaadin/flow-components.git (GITHUB):
Affected version(s) >=23.0.0 <23.6.2
Fix Suggestion:
Update to version 23.6.2
https://github.com/vaadin/flow-components.git (GITHUB):
Affected version(s) >=24.0.0 <24.7.7
Fix Suggestion:
Update to version 24.7.7
com.vaadin:vaadin-server (JAVA):
Affected version(s) >=8.0.0 <8.28.2
Fix Suggestion:
Update to version 8.28.2
com.vaadin:vaadin-server (JAVA):
Affected version(s) >=7.0.0 <7.7.48
Fix Suggestion:
Update to version 7.7.48
com.vaadin:vaadin-upload-flow (JAVA):
Affected version(s) >=2.0.0 <14.13.1
Fix Suggestion:
Update to version 14.13.1
com.vaadin:vaadin-upload-flow (JAVA):
Affected version(s) >=24.0.0 <24.7.7
Fix Suggestion:
Update to version 24.7.7
com.vaadin:vaadin-upload-flow (JAVA):
Affected version(s) >=23.0.0 <23.6.2
Fix Suggestion:
Update to version 23.6.2
Related Resources (7)
https://nvd.nist.gov/vuln/detail/CVE-2025-9467
https://github.com/vaadin/flow-components/pull/7616
https://vaadin.com/security/cve-2025-0000
https://vaadin.com/security/cve-2025-9467
https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635
https://github.com/vaadin/framework
https://github.com/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Unrestricted Upload of File with Dangerous Type
CWE-434
Improper Input Validation
CWE-20
EPSS
Base Score:
0.09