Spring Framework vulnerable to a reflected file download (RFD)

🗓️ 13 Jun 2025 00:33:18Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 9 Views

Spring Framework versions 6.0.x to 6.2.x are vulnerable to reflected file download attacks.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a reflected file download (RFD) attack in Spring Framework [CVE-2025-41234]	28 Aug 202517:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in spring-web-6.2.3.jar(CVE-2025-41234)	7 Oct 202506:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in the Spring framework (CVE-2025-41234)	29 Sep 202523:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202507:00	–	ibm
IBM Security Bulletins	Security Bulletin: Reflected File Download (RFD) Vulnerability in Spring Framework Content-Disposition Header Handling (CWE-113), which affects IBM watsonx.data	27 Oct 202513:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to an issue in Spring Framework	26 Aug 202517:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses an application is vulnerable to a reflected file download (RFD) attack.	9 Jul 202507:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	25 Sep 202516:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	31 Oct 202519:08	–	ibm

Vulners

Node

org.springframework spring-webRange6.0.5–6.0.23maven

OR

org.springframework spring-webRange6.1.0–6.1.21maven

OR

org.springframework spring-webRange6.2.0–6.2.8maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-41234
spring	www.spring.io/security/cve-2025-41234
github	www.github.com/spring-projects/spring-framework/issues/35034
github	www.github.com/spring-projects/spring-framework/commit/f0e7b42704e6b33958f242d91bd690d6ef7ada9c
github	www.github.com/advisories/GHSA-6r3c-xf4w-jxjm

13 Jun 2025 22:12Current

7.3High risk

Vulners AI Score7.3

CVSS 3.16.5

EPSS0.00294

SSVC

spring framework reflected file download content-disposition header user input upgrade fix versions