GHSA-94g8-xv23-7656 Vaadin Flow Components possible file bypass via upload validation on the server-side
Attackers can bypass server-side upload validation in Vaadin Flow Components to upload malicious files, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-94g8-xv23-7656?
GHSA-94g8-xv23-7656 is a vulnerability in com.vaadin:vaadin-upload-flow, published on 4 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Description
When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.
Which versions are affected by GHSA-94g8-xv23-7656?
6 open source packages ship an affected version, including com.vaadin:vaadin-upload-flow.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:vaadin-upload-flow Maven | From 2.0.0 | 14.13.1 |
com.vaadin:vaadin-upload-flow Maven | From 2.0.0 | 14.13.1 |
com.vaadin:vaadin-upload-flow Maven | From 23.0.0 | 23.6.2 |
com.vaadin:vaadin-upload-flow Maven | From 23.0.0 | 23.6.2 |
com.vaadin:vaadin-upload-flow Maven | From 24.0.0 | 24.7.7 |
com.vaadin:vaadin-upload-flow Maven | From 24.0.0 | 24.7.7 |
How do I fix GHSA-94g8-xv23-7656?
Upgrade com.vaadin:vaadin-upload-flow to a fixed version for your release line: 14.13.1, 23.6.2 or 24.7.7.
Is GHSA-94g8-xv23-7656 being exploited?
There is no known exploitation of GHSA-94g8-xv23-7656 in the wild and no public exploit code.