st2-046-poc

Struts2 Content-Disposition filename null-byte variant of CVE-2017-5638 Struts2 Security Bulletin S2-046 A null byte \x00 in a request¡¯s Content-Disposition header filename field can trigger a InvalidFileNameException with the same client controlled filename string in the exception message that ...

CVE-2020-5398

CVE-2020-5398 - RFDReflected File Download Attack for Spring MVC In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header...

CVE-2026-125110

A flaw was found in Rack. An unauthenticated remote attacker can bypass path-specific security headers by requesting files using paths containing raw or percent-encoded dot segments. This issue occurs because the static file serving component normalizes paths when locating files but evaluates...

Better-CVE-2022-29464

Better CVE-2022-29464 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464. CVE-2022-29464 details: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a...

CVE-2026-120326

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...

CVE-2026-120326 Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...

EUVD-2026-120893

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...

CVE-2026-120326

Vaadin Flow is vulnerable to a Content-Disposition parameter injection due to unescaped file names in the DownloadEvent.setFileName(String) method. When an application processes untrusted filenames, an attacker can insert a double quote to prematurely terminate the filename attribute and inject a...

CVE-2026-120326

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...

CVE-2026-120326 Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...

PT-2026-141592

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...

CVE-2026-120326: vaadin: DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header…

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename=" " with the name inserted verbatim, so a double quote in the name ends the quoted strin...

Unescaped download file name allows Content-Disposition parameter injection in Vaadin Flow

DownloadEvent.setFileName writes the download file name into the Content-Disposition header without escaping it, so an application that passes a file name it did not generate lets an attacker add their own header parameters and have the file saved under a name and extension of the attacker's...

CVE-2026-104269

A flaw was found in ModSecurity. The multipart parser fails to properly prioritize parameter handling when processing filenames in Content-Disposition headers. A remote attacker can exploit this discrepancy by submitting a request containing both a benign filename and an encoded alternative that...

DEBIAN-CVE-2026-104269

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename parameter precedence used by common Go, Python, Node.js, and Java application parsers. A...

CVE-2026-104269

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename parameter precedence used by common Go, Python, Node.js, and Java application parsers. A...

CVE-2026-104269 ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename parameter precedence used by common Go, Python, Node.js, and Java application parsers. A...

SUSE CVE-2026-120647

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

SUSE CVE-2026-120641

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can ...