CVE-2025-9467
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-04
Assigner: Vaadin Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vaadin | vaadin | 23.0.0 |
| vaadin | vaadin-server | 8.0.0 |
| vaadin | vaadin-server | 7.0.0 |
| vaadin | vaadin-upload-flow | 24.0.0 |
| vaadin | vaadin | 14.0.0 |
| vaadin | vaadin-upload-flow | 2.0.0 |
| vaadin | vaadin | 24.0.0 |
| vaadin | vaadin-upload-flow | 23.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Vaadin Upload components allows attackers to bypass server-side file upload validation when the start listener is used to validate metadata of incoming uploads. Essentially, improper input validation (CWE-20) enables attackers to circumvent the intended upload restrictions, potentially allowing unauthorized or malicious files to be uploaded. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to bypass upload validation controls, which may lead to unauthorized or malicious files being uploaded to your system. This could result in security risks such as data corruption, unauthorized access, or further exploitation depending on what files are uploaded and how they are processed. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade your Vaadin components to the fixed versions. Specifically, upgrade to at least Vaadin 7.7.48, 8.28.2, 14.13.1, 23.6.2, or 24.7.7 depending on your current version. For Vaadin Upload Flow artifacts, upgrade to at least 14.13.1, 23.6.2, or 24.7.7. Additionally, if you are using unsupported Vaadin versions 10-13 or 15-22, migrate to the latest supported versions 14, 23, or 24. [1]