{"action":"Upgrade com.vaadin:vaadin-server to 7.7.48 (7.x) or 8.28.2 (8.x) or later.","affected":[{"fixed":"7.7.48","introduced":"7.0.0"},{"fixed":"8.28.2","introduced":"8.0.0"}],"component":"com.vaadin:vaadin-server","cve_ids":["CVE-2025-9467"],"ecosystem":"Maven","epss":0.00393,"exploited":false,"fixed_versions":["7.7.48","8.28.2"],"ghsa_id":"GHSA-9gfh-4fwj-w3rj","id":"tcs_01M5N8PZKJJMP94J0Z90XJWCMM","modified_at":"2026-09-10T03:50:28.325392671Z","published_at":"2025-09-04T15:54:58Z","references":["https://osv.dev/vulnerability/GHSA-9gfh-4fwj-w3rj","https://github.com/vaadin/framework/security/advisories/GHSA-9gfh-4fwj-w3rj","https://nvd.nist.gov/vuln/detail/CVE-2025-9467","https://github.com/vaadin/flow-components/pull/7616","https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635","https://github.com/vaadin/framework","https://vaadin.com/security/cve-2025-9467"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-9gfh-4fwj-w3rj","url":"https://osv.dev/vulnerability/GHSA-9gfh-4fwj-w3rj"},{"source":"nvd","source_id":"CVE-2025-9467","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9467"}],"summary":"Vaadin Framework possible file bypass via upload validation on the server-side"}