EUVD-2025-18218

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Spring Framework 6.0.x, 6.1.x, 6.2.x are vulnerable to reflected file download attack via unvalidated input.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a reflected file download (RFD) attack in Spring Framework [CVE-2025-41234]	28 Aug 202517:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in spring-web-6.2.3.jar(CVE-2025-41234)	7 Oct 202506:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in the Spring framework (CVE-2025-41234)	29 Sep 202523:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202507:00	–	ibm
IBM Security Bulletins	Security Bulletin: Reflected File Download (RFD) Vulnerability in Spring Framework Content-Disposition Header Handling (CWE-113), which affects IBM watsonx.data	27 Oct 202513:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to an issue in Spring Framework	26 Aug 202517:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses an application is vulnerable to a reflected file download (RFD) attack.	9 Jul 202507:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	25 Sep 202516:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	31 Oct 202519:08	–	ibm

[
  {
    "enisaIdVendor": [
      {
        "id": "40bf50e3-c63b-368a-aa30-89b2d3c752a9",
        "vendor": {
          "name": "VMware"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "100252d3-9e13-3908-a758-42a02b1216d6",
        "product": {
          "name": "Spring Framework"
        },
        "product_version": "6.1.0 ≤6.1.20"
      },
      {
        "id": "6f81fc7e-11fd-37a8-99d9-8155ad6943c3",
        "product": {
          "name": "Spring Framework"
        },
        "product_version": "6.2.0 ≤6.2.7"
      },
      {
        "id": "93eb4ba7-c985-3c99-b126-aafc834a5af8",
        "product": {
          "name": "Spring Framework"
        },
        "product_version": "6.0.5 ≤6.0.28"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2025-41234
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-41234
nvd	www.nvd.nist.gov/vuln-metrics/cvss/v3-calculator

03 Oct 2025 20:07Current

7.7High risk

Vulners AI Score7.7

CVSS 3.16.5

EPSS0.00294

SSVC