Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow
- Severity
- Medium 4.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Overview
DownloadEvent.setFileName writes the download file name into the Content-Disposition header without escaping it, so an application that passes a file name it did not generate lets an attacker add their own header parameters and have the file saved under a name and extension of the attacker's choosing. This vulnerability has been addressed in the latest supported versions of Vaadin. Users are advised to upgrade.
Are you affected?
- Affected: applications that pass a file name they did not generate themselves to DownloadEvent.setFileName or DownloadEvent.inline, on Vaadin 24.8 through 25.3. The case that occurs in practice is re-serving a file under the name a user uploaded it with.
- Not affected: applications that only pass file names they generate themselves, applications on Vaadin 24.7 or older, where the API does not exist, and applications already on the fixed versions below.
- What to do: update to the fixed version for your Vaadin line, in the table below. No code changes are needed.
Description
When the file name is pure US-ASCII, Vaadin writes the header as attachment; filename="<name>" with the name inserted verbatim. A double quote in the name closes the quoted string early, and whatever follows is read by the browser as further header parameters. RFC 6266 requires a double quote and a backslash to be escaped. The inline variant, present from Vaadin 25.0, builds the name the same way.
An attacker who can get an unescaped name into the application adds a filename* parameter of their own. Browsers prefer filename* over filename, so the file is saved under the attacker's name and extension, which defeats a file name or extension restriction the application believes it is enforcing. The attacker cannot change the attachment or inline disposition itself, and cannot split the header, because CR and LF in a header value are rejected or stripped by the servlet container.
Fixed versions
Update to the version listed for your Vaadin line:
| Vaadin version | Maintenance status | Update to | How to get it |
|---|---|---|---|
| 25.3 | Free maintenance | 25.3.5 | Free |
| 25.2 | Free maintenance | 25.2.13 | Free |
| 25.1 | End of life | 25.2.13 or newer | Free, after moving to 25.2 |
| 25.0 | End of life | 25.2.13 or newer | Free, after moving to 25.2 |
| 24.10 | Extended Maintenance | 24.10.14 | Enterprise subscription |
| 24.9 | Extended Maintenance | 24.9.26 | Enterprise subscription |
| 24.8 | End of life | 24.9.26 or newer | Enterprise subscription |
Vaadin 24.7 and older are not affected. The 24.8, 25.0 and 25.1 lines received no fix of their own and will not get one.
Can't upgrade right away?
Reject or escape double quotes, backslashes and control characters in any file name your application did not generate itself, before passing it to setFileName or inline.
Running an older Vaadin version?
The Vaadin 24 line is no longer under free maintenance, so 24.9.26 and 24.10.14 are available to Extended Maintenance customers. If you are on Vaadin 24 and cannot move to 25 yet, Extended Maintenance keeps your application patched against issues like this one.
Artifacts
| Maven coordinates | Vulnerable version | Fixed version |
|---|---|---|
| com.vaadin:vaadin | 24.8.0 - 24.8.17 | ≥24.9.26 |
| com.vaadin:vaadin | 24.9.0 - 24.9.25 | ≥24.9.26 |
| com.vaadin:vaadin | 24.10.0 - 24.10.13 | ≥24.10.14 |
| com.vaadin:vaadin | 25.0.0 - 25.0.13 | ≥25.2.13 |
| com.vaadin:vaadin | 25.1.0 - 25.1.13 | ≥25.2.13 |
| com.vaadin:vaadin | 25.2.0 - 25.2.12 | ≥25.2.13 |
| com.vaadin:vaadin | 25.3.0 - 25.3.4 | ≥25.3.5 |
| com.vaadin:vaadin-core | 24.8.0 - 24.8.17 | ≥24.9.26 |
| com.vaadin:vaadin-core | 24.9.0 - 24.9.25 | ≥24.9.26 |
| com.vaadin:vaadin-core | 24.10.0 - 24.10.13 | ≥24.10.14 |
| com.vaadin:vaadin-core | 25.0.0 - 25.0.13 | ≥25.2.13 |
| com.vaadin:vaadin-core | 25.1.0 - 25.1.13 | ≥25.2.13 |
| com.vaadin:vaadin-core | 25.2.0 - 25.2.12 | ≥25.2.13 |
| com.vaadin:vaadin-core | 25.3.0 - 25.3.4 | ≥25.3.5 |
| com.vaadin:flow-server | 24.8.0 - 24.8.16 | ≥24.9.31 |
| com.vaadin:flow-server | 24.9.0 - 24.9.30 | ≥24.9.31 |
| com.vaadin:flow-server | 24.10.0 - 24.10.16 | ≥24.10.17 |
| com.vaadin:flow-server | 25.0.0 - 25.0.15 | ≥25.2.16 |
| com.vaadin:flow-server | 25.1.0 - 25.1.19 | ≥25.2.16 |
| com.vaadin:flow-server | 25.2.0 - 25.2.15 | ≥25.2.16 |
| com.vaadin:flow-server | 25.3.0 - 25.3.5 | ≥25.3.6 |
Credits
Found internally at Vaadin.
References
Questions about this advisory can be sent to security@vaadin.com.
History
- 2026-11-10: Initial vulnerability report published