CVE-2026-120326— Vaadin Flow 未转义下载文件名导致内容处置参数注入漏洞
一分钟漏洞结论
影响对象
vaadin vaadin
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Vaadin Flow 中， 方法将下载文件名直接写入 响应头，而未对其进行转义处理。当文件名仅包含纯 US-ASCII 字符时，该头部的构建格式为 ，其中文件名被原样插入。因此，若文件名中包含双引号，会导致引号提前闭合，浏览器会将剩余部分解析为额外的头部参数。自 Vaadin 25.0 起存在的 变体也采用相同的构建方式。 如果应用程序将不可信的文件名传递给上述任一方法（例如，在重新提供文件时沿用其上传时的原始名称），攻击者便可借此注入 参数。由于浏览器优先采用 而非 ，文件将被保存为攻击者指定的名称和扩展名
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-120326 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow
来源: CVE Program / CVE List V5
Vulnerability Description
DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="<name>" with the name inserted verbatim, so a double quote in the name ends the quoted string early and the rest of the name is read by the browser as further header parameters. The inline(String) variant, present from Vaadin 25.0, builds the name the same way. An application that passes an untrusted file name to either method, for example when re-serving a file under the name it was uploaded with, lets an attacker add a filename* parameter. Browsers prefer filename* over filename, so the file is saved under a name and extension of the attacker's choosing, which defeats any file name or extension restriction the application enforces. The attacker cannot change the attachment or inline disposition itself and cannot split the header.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 24.8.0 - 24.8.17
Vaadin 24.9.0 - 24.9.25
Vaadin 24.10.0 - 24.10.13
Vaadin 25.0.0 - 25.0.13
Vaadin 25.1.0 - 25.1.13
Vaadin 25.2.0 - 25.2.12
Vaadin 25.3.0 - 25.3.4
Mitigation
No fixed release on this line, upgrade to 24.9.26 or newer
Upgrade to 24.9.26
Upgrade to 24.10.14
No fixed release on this line, upgrade to 25.2.13 or newer
No fixed release on this line, upgrade to 25.2.13 or newer
Upgrade to 25.2.13
Upgrade to 25.3.5
Vaadin versions below 24.8 are not affected: the DownloadEvent API does not exist in them.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-120326 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-120326 的情报信息
请登录查看更多情报信息。