GHSA-c7v7-rqfm-f44j Vaadin Platform possible file bypass via upload validation on the server-side
Attackers can bypass server-side upload validation in Vaadin Upload, potentially uploading malicious files to execute code or modify data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-c7v7-rqfm-f44j?
GHSA-c7v7-rqfm-f44j is a vulnerability in com.vaadin:vaadin, published on 4 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Description
When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.
Which versions are affected by GHSA-c7v7-rqfm-f44j?
6 open source packages ship an affected version, including com.vaadin:vaadin.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:vaadin Maven | From 14.0.0 | 14.13.1 |
com.vaadin:vaadin Maven | From 14.0.0 | 14.13.1 |
com.vaadin:vaadin Maven | From 23.0.0 | 23.6.2 |
com.vaadin:vaadin Maven | From 23.0.0 | 23.6.2 |
com.vaadin:vaadin Maven | From 24.0.0 | 24.7.7 |
com.vaadin:vaadin Maven | From 24.0.0 | 24.7.7 |
How do I fix GHSA-c7v7-rqfm-f44j?
Upgrade com.vaadin:vaadin to a fixed version for your release line: 14.13.1, 23.6.2 or 24.7.7.
Is GHSA-c7v7-rqfm-f44j being exploited?
There is no known exploitation of GHSA-c7v7-rqfm-f44j in the wild and no public exploit code.