What is GHSA-9gfh-4fwj-w3rj?

GHSA-9gfh-4fwj-w3rj is a security advisory published by GitHub Security Advisories with Medium severity. Vaadin Framework possible file bypass via upload validation on the server-side

Which CVE IDs does GHSA-9gfh-4fwj-w3rj cover?

GHSA-9gfh-4fwj-w3rj covers the following CVE IDs: CVE-2025-9467. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-9gfh-4fwj-w3rj?

GHSA-9gfh-4fwj-w3rj affects 2 products, including: maven/com.vaadin:vaadin-server:\u003e= 7.0.0, \u003c= 7.7.47; maven/com.vaadin:vaadin-server:\u003e= 8.0.0, \u003c= 8.28.1.

GHSA-9gfh-4fwj-w3rjMedium

Vaadin Framework possible file bypass via upload validation on the server-side

Vendor

GitHub Security Advisories

Published

September 4, 2025

Last Modified

September 4, 2025

🔗 CVE IDs covered (1)

CVE-2025-9467 →

📋 Description

Description

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.

🎯 Affected products2

maven/com.vaadin:vaadin-server:>= 7.0.0, <= 7.7.47
maven/com.vaadin:vaadin-server:>= 8.0.0, <= 8.28.1

🔗 References (6)

https://github.com/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj
https://nvd.nist.gov/vuln/detail/CVE-2025-9467
https://github.com/vaadin/flow-components/pull/7616
https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635
https://vaadin.com/security/cve-2025-9467
https://github.com/advisories/GHSA-9gfh-4fwj-w3rj