{"action":"Upgrade com.vaadin:vaadin to 14.13.1 (14.x), 23.6.2 (23.x) or 24.7.7 (24.x) or later.","affected":[{"fixed":"14.13.1","introduced":"14.0.0"},{"fixed":"23.6.2","introduced":"23.0.0"},{"fixed":"24.7.7","introduced":"24.0.0"}],"component":"com.vaadin:vaadin","cve_ids":[],"ecosystem":"Maven","exploited":false,"fixed_versions":["14.13.1","23.6.2","24.7.7"],"ghsa_id":"GHSA-c7v7-rqfm-f44j","id":"tcs_01M5N8RVCESX7DM14JENA7BWQN","modified_at":"2026-09-10T03:50:28.288668407Z","published_at":"2025-09-04T15:55:09Z","references":["https://osv.dev/vulnerability/GHSA-c7v7-rqfm-f44j","https://github.com/vaadin/platform/security/advisories/GHSA-c7v7-rqfm-f44j","https://nvd.nist.gov/vuln/detail/CVE-2025-9467","https://github.com/vaadin/flow-components/pull/7616","https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635","https://github.com/vaadin/platform","https://vaadin.com/security/cve-2025-9467"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-c7v7-rqfm-f44j","url":"https://osv.dev/vulnerability/GHSA-c7v7-rqfm-f44j"}],"summary":"Vaadin Platform possible file bypass via upload validation on the server-side"}