Vaadin Upload Validation Bypass Vulnerability

A vulnerability exists in Vaadin Upload components that allows users to bypass upload validation when the start listener is used to check metadata of incoming files. This issue affects several Vaadin versions, including Vaadin 7, 8, 14, 23, and 24, as well as the Vaadin Upload Flow component in corresponding versions. The vulnerability arises from improper input validation, enabling potential manipulation of upload metadata to circumvent established validation rules.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, potentially allowing for the upload of malicious files that could be executed or processed by the application.

Remediation

Users should upgrade to Vaadin versions 7.7.48, 8.28.2, 14.13.1, 23.6.2, or 24.7.7 and newer. For Vaadin Upload Flow, upgrade to versions 14.13.1, 23.6.2, or 24.7.7 and newer. Note that Vaadin versions 10-13 and 15-22 are no longer supported, and users should update to the latest version of 14, 23, or 24.