GHSA-c7v7-rqfm-f44j

Suggest an improvement
Source
https://github.com/advisories/GHSA-c7v7-rqfm-f44j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-c7v7-rqfm-f44j/GHSA-c7v7-rqfm-f44j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c7v7-rqfm-f44j
Published
2025-09-04T15:55:09Z
Modified
2026-09-10T03:50:28Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Green CVSS Calculator
Summary
Vaadin Platform possible file bypass via upload validation on the server-side
Details

Description

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.

Database specific 
{
    "cwe_ids":  [
        "CWE-20",
        "CWE-434"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-04T15:55:09Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Maven / com.vaadin:vaadin

Package

Name
com.vaadin:vaadin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14.0.0
Fixed
14.13.1

Affected versions

14.*
14.0.0
14.0.1
14.0.2
14.0.3
14.0.4
14.0.5
14.0.6
14.0.7
14.0.8
14.0.9
14.0.10
14.0.11
14.0.12
14.0.13
14.0.14
14.0.15
14.1.0
14.1.1
14.1.2
14.1.3
14.1.4
14.1.5
14.1.16
14.1.17
14.1.18
14.1.19
14.1.20
14.1.21
14.1.22
14.1.23
14.1.24
14.1.25
14.1.26
14.1.27
14.1.28
14.2.0
14.2.1
14.2.2
14.2.3
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.3.6
14.3.7
14.3.8
14.3.9
14.4.0
14.4.1
14.4.2
14.4.3
14.4.4
14.4.5
14.4.6
14.4.7
14.4.8
14.4.9
14.4.10
14.5.0
14.5.1
14.5.2
14.5.3
14.5.4
14.5.5
14.6.0
14.6.1
14.6.2
14.6.3
14.6.4
14.6.5
14.6.6
14.6.7
14.6.8
14.6.9
14.7.0
14.7.1
14.7.2
14.7.3
14.7.4
14.7.5
14.7.6
14.7.7
14.7.8
14.8.0
14.8.1
14.8.2
14.8.3
14.8.4
14.8.5
14.8.6
14.8.7
14.8.8
14.8.9
14.8.10
14.8.11
14.8.12
14.8.13
14.8.14
14.8.15
14.8.16
14.8.17
14.8.18
14.8.19
14.8.20
14.9.0
14.9.1
14.9.2
14.9.3
14.9.4
14.9.5
14.9.6
14.9.7
14.9.8
14.10.0
14.10.1
14.10.2
14.10.3
14.10.4
14.10.5
14.10.6
14.10.7
14.10.8
14.10.9
14.10.10
14.10.11
14.10.12
14.11.0
14.11.1
14.11.2
14.11.3
14.11.4
14.11.5
14.11.6
14.11.7
14.11.8
14.11.9
14.11.10
14.11.11
14.11.12
14.11.13
14.11.14
14.12.0
14.12.1
14.12.2
14.12.3
14.12.4
14.12.5
14.12.6
14.12.7
14.12.8
14.13.0

Database specific

last_known_affected_version_range 
"<= 14.13.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-c7v7-rqfm-f44j/GHSA-c7v7-rqfm-f44j.json"

Maven / com.vaadin:vaadin

Package

Name
com.vaadin:vaadin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
23.0.0
Fixed
23.6.2

Affected versions

23.*
23.0.0
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
23.0.8
23.0.9
23.0.10
23.0.11
23.0.12
23.0.13
23.0.14
23.0.15
23.0.16
23.1.0
23.1.1
23.1.2
23.1.3
23.1.4
23.1.6
23.1.7
23.1.8
23.1.9
23.1.10
23.1.11
23.1.12
23.1.13
23.1.14
23.1.15
23.1.16
23.1.17
23.2.0
23.2.1
23.2.2
23.2.3
23.2.4
23.2.5
23.2.6
23.2.7
23.2.8
23.2.9
23.2.10
23.2.11
23.2.12
23.2.13
23.2.14
23.2.15
23.2.16
23.2.17
23.3.0
23.3.1
23.3.2
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.25
23.3.26
23.3.27
23.3.28
23.3.29
23.3.30
23.3.31
23.3.32
23.3.33
23.3.34
23.3.35
23.4.0
23.4.1
23.4.2
23.5.0
23.5.1
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.5.10
23.5.11
23.5.12
23.5.13
23.5.14
23.5.15
23.5.16
23.5.17
23.5.18
23.6.0
23.6.1

Database specific

last_known_affected_version_range 
"<= 23.6.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-c7v7-rqfm-f44j/GHSA-c7v7-rqfm-f44j.json"

Maven / com.vaadin:vaadin

Package

Name
com.vaadin:vaadin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.0.0
Fixed
24.7.7

Affected versions

24.*
24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
24.0.6
24.0.7
24.0.8
24.0.9
24.0.10
24.0.11
24.0.12
24.0.13
24.0.14
24.0.15
24.1.0
24.1.1
24.1.2
24.1.3
24.1.4
24.1.5
24.1.6
24.1.7
24.1.8
24.1.9
24.1.10
24.1.11
24.1.12
24.1.13
24.1.14
24.1.15
24.1.16
24.1.17
24.1.18
24.2.0
24.2.1
24.2.2
24.2.3
24.2.4
24.2.5
24.2.6
24.2.7
24.2.8
24.2.9
24.2.10
24.2.11
24.2.12
24.2.13
24.3.0
24.3.1
24.3.2
24.3.3
24.3.4
24.3.5
24.3.6
24.3.7
24.3.8
24.3.9
24.3.10
24.3.11
24.3.12
24.3.13
24.3.14
24.3.15
24.3.16
24.3.17
24.3.18
24.3.19
24.3.20
24.3.21
24.4.0
24.4.1
24.4.2
24.4.3
24.4.4
24.4.5
24.4.6
24.4.7
24.4.8
24.4.9
24.4.10
24.4.11
24.4.12
24.4.13
24.4.14
24.4.15
24.4.16
24.4.17
24.4.18
24.4.19
24.4.20
24.4.21
24.4.22
24.4.23
24.5.0
24.5.1
24.5.2
24.5.3
24.5.4
24.5.5
24.5.6
24.5.7
24.5.8
24.5.9
24.5.10
24.5.11
24.5.12
24.5.13
24.5.14
24.5.15
24.6.0
24.6.1
24.6.2
24.6.3
24.6.4
24.6.5
24.6.6
24.6.7
24.6.8
24.6.9
24.6.10
24.6.11
24.6.12
24.6.13
24.7.0
24.7.1
24.7.2
24.7.3
24.7.4
24.7.5
24.7.6

Database specific

last_known_affected_version_range 
"<= 24.7.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-c7v7-rqfm-f44j/GHSA-c7v7-rqfm-f44j.json"