Reflected File Download Vulnerability in Spring Framework by VMware

CVE-2025-41234

What is CVE-2025-41234?

A vulnerability in VMware's Spring Framework affects versions 6.0.5 to 6.2.7, enabling attackers to exploit reflected file download (RFD) attacks. This occurs when an application improperly handles the 'Content-Disposition' header by using non-ASCII charsets for filenames derived from user input without proper sanitization. Attackers can inject malicious commands into the response content, potentially compromising application security. To mitigate this risk, users should promptly upgrade to the fixed versions available.

References