CVE-2025-9467
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedWhen the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.47 Vaadin 8.0.0 - 8.28.1 Vaadin 14.0.0 - 14.13.0 Vaadin 23.0.0 - 23.6.1 Vaadin 24.0.0 - 24.7.6 Mitigation Upgrade to 7.7.48 Upgrade to 8.28.2 Upgrade to 14.13.1 Upgrade to 23.6.2 Upgrade to 24.7.7 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24 version. Artifacts Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.47 ≥7.7.48 com.vaadin:vaadin-server 8.0.0 - 8.28.1 ≥8.28.2 com.vaadin:vaadin 14.0.0 - 14.13.0 ≥14.13.1 com.vaadin:vaadin23.0.0 - 23.6.1 ≥23.6.2 com.vaadin:vaadin24.0.0 - 24.7.6 ≥24.7.7com.vaadin:vaadin-upload-flow 2.0.0 - 14.13.0 ≥14.13.1 com.vaadin:vaadin-upload-flow 23.0.0 - 23.6.1 ≥23.6.2 com.vaadin:vaadin-upload-flow 24.0.0 - 24.7.6 ≥24.7.7
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceVaadin Upload component contains a validation bypass vulnerability where the start listener's metadata validation can be circumvented, allowing files to be uploaded despite the validation logic rejecting them. This affects the server-side upload handling in the framework across multiple major version branches.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- Authentication
- None
- User interaction
- None
- Scope
- N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the Vaadin framework version in useExamine your project's build configuration files (pom.xml, build.gradle, package.json, or requirements.txt) to locate the Vaadin dependency and its version numberAffected if The Vaadin version is less than 7.7.48, 8.28.2, 14.13.1, 23.6.2, or 24.7.7 depending on your major version branch
-
Confirm the Vaadin Upload component is in useSearch your codebase for imports or references to com.vaadin.ui.Upload (Vaadin 7-8) or com.vaadin.flow.component.upload.Upload (Vaadin 10+) and check if Upload components are instantiated in your application codeAffected if The Upload component class is imported or used in your project
-
Check if a start listener with metadata validation is configuredSearch your Upload component configuration code for calls to addStartListener or setStartListener, and examine whether file type, size, or other metadata validation is performed in that listenerAffected if A start listener exists that performs metadata validation to restrict uploads
-
Verify upload handling occurs in your running applicationReview your application's upload handling endpoints or components to confirm files are being processed through the Vaadin Upload pathwayAffected if The application processes file uploads through the Vaadin Upload component
You are affected if your Vaadin framework version is below the fixed releases (7.7.48, 8.28.2, 14.13.1, 23.6.2, or 24.7.7) AND you use the Upload component with a start listener that performs metadata validation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade Vaadin framework to the fixed versions (7.7.48, 8.28.2, 14.13.1, 23.6.2, or 24.7.7+) to patch the validation bypass in the Upload component's start listener.
Upgrade to the latest version in your current Vaadin line: 7.7.48 (7.x), 8.28.2 (8.x), 14.14.x (14.x), 23.6.x (23.x), or 24.x (24.x)
- Identify which Vaadin version line is used in the project (7.x, 8.x, 14.x, 23.x, or 24.x) by checking pom.xml or build.gradle dependencies
- For Vaadin 7.x projects: update com.vaadin:vaadin-server dependency to version 7.7.48
- For Vaadin 8.x projects: update com.vaadin:vaadin-server dependency to version 8.28.2
- For Vaadin 14.x projects: update com.vaadin:vaadin dependency to version 14.13.1 (or 14.14.x latest)
- For Vaadin 23.x projects: update com.vaadin:vaadin dependency to version 23.6.2 (or 23.6.x latest)
- For Vaadin 24.x projects: update com.vaadin:vaadin dependency to version 24.7.7 (or 24.x latest)
- If using vaadin-upload-flow, also update that dependency to the same version as the core vaadin artifact
- Run mvn clean install or gradle build to verify the upgrade compiles successfully
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,096.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-9467 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-9467 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data