com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by unknown CVE via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-94G8-XV23-7656...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by unknown CVE via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-94G8-XV23-7656...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2025-9467 Source advisory:...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: CVE-2025-9467 Source advisory: GHSA-94G8-XV23-7656...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: CVE-2025-9467 Source advisory: SNYK:JAVA-COMVAADIN-12496926...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2025-9467 Source advisory:...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via Vaadin Upload's start listener in the multi-upload mode. An attacker can upload unauthorized files by bypassing server-side metadata validation. Remediation Upgrade com.vaadin:vaadin-upload-flow to version...

CVE-2025-9467

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 -...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: CVE-2025-9467 Source advisory: MEND:CVE-2025-9467...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2025-9467 Source advisory:...

ch.artaios:openchemlib-vaadin (>=1.0.0, <=2.4.1), ch.jubnl:vsecureflow (>=0.0.15, <=0.0.16) +185 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=24.0.0, <=24.7.6)

com.vaadin:vaadin-upload-flow MAVEN version =24.0.0, =1.0.0, =0.0.15, =1.1.5, =1.0.0, =24.3.0-alpha1, =24.4.0-beta1, =2.0.0-alpha1, =24.4.0-beta1, =24.4.0-beta1, =2.0.0-alpha1, =24.7.1 and more Source cves: CVE-2025-9467 Source advisory: MEND:CVE-2025-9467...

CVE-2025-9467: Improper Input Validation

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 -...