6 matches found
CVE-2026-120326
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
CVE-2026-120326
Vaadin Flow is vulnerable to a Content-Disposition parameter injection due to unescaped file names in the DownloadEvent.setFileName(String) method. When an application processes untrusted filenames, an attacker can insert a double quote to prematurely terminate the filename attribute and inject a...
EUVD-2026-120893
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
CVE-2026-120326 Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
PT-2026-141592
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...
CVE-2026-120326: vaadin: DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header…
DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename=" " with the name inserted verbatim, so a double quote in the name ends the quoted strin...