GHSA-94g8-xv23-7656

Suggest an improvement
Source
https://github.com/advisories/GHSA-94g8-xv23-7656
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-94g8-xv23-7656/GHSA-94g8-xv23-7656.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-94g8-xv23-7656
Published
2025-09-04T15:55:04Z
Modified
2025-09-04T16:15:36Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Green CVSS Calculator
Summary
Vaadin Flow Components possible file bypass via upload validation on the server-side
Details

Description

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.

Database specific 
{
    "cwe_ids":  [
        "CWE-20",
        "CWE-434"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-04T15:55:04Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Maven / com.vaadin:vaadin-upload-flow

Package

Name
com.vaadin:vaadin-upload-flow
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-upload-flow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
14.13.1

Affected versions

2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.3.2
3.*
3.0.0
3.1.0
4.*
4.0.0
4.0.1
14.*
14.5.0
14.5.1
14.5.2
14.5.3
14.5.4
14.5.5
14.6.0
14.6.1
14.6.2
14.6.3
14.6.4
14.6.5
14.6.6
14.6.7
14.6.8
14.6.9
14.7.0
14.7.1
14.7.2
14.7.3
14.7.4
14.7.5
14.7.6
14.7.7
14.7.8
14.8.0
14.8.1
14.8.2
14.8.3
14.8.4
14.8.5
14.8.6
14.8.7
14.8.8
14.8.9
14.8.10
14.8.11
14.8.12
14.8.13
14.8.14
14.8.15
14.8.16
14.8.17
14.8.18
14.8.19
14.8.20
14.9.0
14.9.1
14.9.2
14.9.3
14.9.4
14.9.5
14.9.6
14.9.7
14.9.8
14.10.0
14.10.1
14.10.2
14.10.3
14.10.4
14.10.5
14.10.6
14.10.7
14.10.8
14.10.9
14.10.10
14.10.11
14.10.12
14.11.0
14.11.1
14.11.2
14.11.3
14.11.4
14.11.5
14.11.6
14.11.7
14.11.8
14.11.9
14.11.10
14.11.11
14.11.12
14.11.13
14.12.0
14.12.1
14.12.2
14.12.3
14.12.4
14.12.5
14.12.6
14.12.7
14.12.8
14.13.0

Database specific

last_known_affected_version_range 
"<= 14.13.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-94g8-xv23-7656/GHSA-94g8-xv23-7656.json"

Maven / com.vaadin:vaadin-upload-flow

Package

Name
com.vaadin:vaadin-upload-flow
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-upload-flow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
23.0.0
Fixed
23.6.2

Affected versions

23.*
23.0.0
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
23.0.8
23.0.9
23.0.10
23.0.11
23.0.12
23.0.13
23.0.14
23.0.15
23.0.16
23.1.0
23.1.1
23.1.2
23.1.3
23.1.4
23.1.5
23.1.6
23.1.7
23.1.8
23.1.9
23.1.10
23.1.11
23.1.12
23.1.13
23.1.14
23.1.15
23.1.16
23.1.17
23.2.0
23.2.1
23.2.2
23.2.3
23.2.4
23.2.5
23.2.6
23.2.7
23.2.8
23.2.9
23.2.10
23.2.11
23.2.12
23.2.13
23.2.14
23.2.15
23.2.16
23.2.17
23.3.0
23.3.1
23.3.2
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.25
23.3.26
23.3.27
23.3.28
23.3.29
23.3.30
23.3.31
23.3.32
23.3.33
23.3.34
23.3.35
23.4.0
23.4.1
23.5.0
23.5.1
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.5.10
23.5.11
23.5.12
23.5.13
23.5.14
23.5.15
23.5.16
23.5.17
23.5.18
23.6.0
23.6.1

Database specific

last_known_affected_version_range 
"<= 23.6.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-94g8-xv23-7656/GHSA-94g8-xv23-7656.json"

Maven / com.vaadin:vaadin-upload-flow

Package

Name
com.vaadin:vaadin-upload-flow
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-upload-flow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.0.0
Fixed
24.7.7

Affected versions

24.*
24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
24.0.6
24.0.7
24.0.8
24.0.9
24.0.10
24.0.11
24.0.12
24.0.13
24.0.14
24.1.0
24.1.1
24.1.2
24.1.3
24.1.4
24.1.5
24.1.6
24.1.7
24.1.8
24.1.9
24.1.10
24.1.11
24.1.12
24.1.13
24.1.14
24.1.15
24.1.16
24.2.0
24.2.1
24.2.2
24.2.3
24.2.4
24.2.5
24.2.6
24.2.7
24.2.8
24.2.9
24.2.10
24.2.11
24.2.12
24.3.0
24.3.1
24.3.2
24.3.3
24.3.4
24.3.5
24.3.6
24.3.7
24.3.8
24.3.9
24.3.10
24.3.11
24.3.12
24.3.13
24.3.14
24.3.15
24.3.16
24.3.17
24.3.18
24.3.19
24.3.20
24.4.0
24.4.1
24.4.2
24.4.3
24.4.4
24.4.5
24.4.6
24.4.7
24.4.8
24.4.9
24.4.10
24.4.11
24.4.12
24.4.13
24.4.14
24.4.15
24.4.16
24.4.17
24.4.18
24.4.19
24.4.20
24.4.21
24.4.22
24.5.0
24.5.1
24.5.2
24.5.3
24.5.4
24.5.5
24.5.6
24.5.7
24.5.8
24.5.9
24.5.10
24.5.11
24.5.12
24.5.13
24.5.14
24.6.0
24.6.1
24.6.2
24.6.3
24.6.4
24.6.5
24.6.6
24.6.7
24.6.8
24.6.9
24.6.10
24.6.11
24.6.12
24.7.0
24.7.1
24.7.2
24.7.3
24.7.4
24.7.5
24.7.6

Database specific

last_known_affected_version_range 
"<= 24.7.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-94g8-xv23-7656/GHSA-94g8-xv23-7656.json"