Vulnerability in DownloadEvent of Vaadin Flow Affects File Handling

CVE-2026-120326

What is CVE-2026-120326?

The DownloadEvent.setFileName(String) in Vaadin Flow introduces a vulnerability that allows an attacker to manipulate the Content-Disposition header by inserting untrusted file names. This occurs when a filename containing characters, such as quotes, is processed without proper escaping. Consequently, the browser misinterprets the intended filename, potentially saving files with incorrect names or extensions. Affected users are advised to upgrade to specific versions to mitigate this issue effectively.

References