Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120326— Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow

Quick assessment

Affected
vaadin vaadin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Vaadin Flow 中， 方法将下载文件名直接写入 响应头，而未对其进行转义处理。当文件名仅包含纯 US-ASCII 字符时，该头部的构建格式为 ，其中文件名被原样插入。因此，若文件名中包含双引号，会导致引号提前闭合，浏览器会将剩余部分解析为额外的头部参数。自 Vaadin 25.0 起存在的 变体也采用相同的构建方式。 如果应用程序将不可信的文件名传递给上述任一方法（例如，在重新提供文件时沿用其上传时的原始名称），攻击者便可借此注入 参数。由于浏览器优先采用 而非 ，文件将被保存为攻击者指定的名称和扩展名

CVSS 4.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120326

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unescaped Download File Name Allows Content-Disposition Parameter Injection in Vaadin Flow
Source: CVE Program / CVE List V5
Vulnerability Description
DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="<name>" with the name inserted verbatim, so a double quote in the name ends the quoted string early and the rest of the name is read by the browser as further header parameters. The inline(String) variant, present from Vaadin 25.0, builds the name the same way. An application that passes an untrusted file name to either method, for example when re-serving a file under the name it was uploaded with, lets an attacker add a filename* parameter. Browsers prefer filename* over filename, so the file is saved under a name and extension of the attacker's choosing, which defeats any file name or extension restriction the application enforces. The attacker cannot change the attachment or inline disposition itself and cannot split the header. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.25 Vaadin 24.10.0 - 24.10.13 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.12 Vaadin 25.3.0 - 25.3.4 Mitigation No fixed release on this line, upgrade to 24.9.26 or newer Upgrade to 24.9.26 Upgrade to 24.10.14 No fixed release on this line, upgrade to 25.2.13 or newer No fixed release on this line, upgrade to 25.2.13 or newer Upgrade to 25.2.13 Upgrade to 25.3.5 Vaadin versions below 24.8 are not affected: the DownloadEvent API does not exist in them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vaadin vaadin 24.8.0 ~ 24.8.17 -
vaadin vaadin-core 24.8.0 ~ 24.8.17 -
vaadin flow 24.8.0 ~ 24.8.16 -

II. Public POCs for CVE-2026-120326

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120326

请登录查看更多情报信息。

Other References for CVE-2026-120326 (2)

IV. Related Vulnerabilities

Same product: vaadin
Same vendor: vaadin
Same weakness: CWE-116