CVE-2025-41234: Spring Framework Reflected File Download Vulnerability
Summary
CVE-2025-41234: Spring Framework vulnerable to a reflected file download (RFD). Affects org.springframework:spring-web across 3 version ranges.
>= 6.0.5, <= 6.0.23
>= 6.1.0, < 6.1.21
>= 6.2.0, < 6.2.8
Fixed in 6.1.21 or 6.2.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. It offers features such as dependency injection, aspect-oriented programming, and transaction management. However, certain versions of the Spring Framework are vulnerable to a reflected file download (RFD) attack, which can lead to unauthorized file downloads if not properly managed.
Vulnerability Detail
In Spring Framework versions 6.0.x (6.0.5 to 6.0.28), 6.1.x (6.1.0 to 6.1.20), and 6.2.x (6.2.0 to 6.2.7), an application is susceptible to a reflected file download (RFD) attack when it sets a 'Content-Disposition' header with a non-ASCII charset, where the filename is derived from user input. This vulnerability arises when user-supplied input is not sanitized, allowing attackers to inject malicious commands into the downloaded content. The consequences of this vulnerability can lead to unauthorized access to sensitive files or execution of harmful scripts on the user's machine.
How To Fix
Latest published version: 7.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.1.0, < 6.1.216.1.21 -
>= 6.2.0, < 6.2.86.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, ensure that the application does not set a 'Content-Disposition' response header or sanitize user input thoroughly before using it in the filename attribute. This can help mitigate the risk of RFD attacks.
Conclusion
The Spring Framework vulnerability CVE-2025-41234 poses a significant risk due to its potential for reflected file download attacks. It is crucial for users of affected versions to upgrade to the patched versions to ensure the security of their applications. Additionally, employing proper input sanitization can help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for org.springframework:spring-web →
FAQ
A reflected file download (RFD) attack occurs when an application allows an attacker to manipulate the filename in a 'Content-Disposition' header, leading to the download of malicious files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using your pom.xml file, you can check if your application is affected without needing to access the code or install anything.
The consequences can include unauthorized access to sensitive files, execution of harmful scripts, and potential compromise of user systems.
Yes, you can mitigate the risk by ensuring that the application does not set a 'Content-Disposition' response header or by sanitizing user input thoroughly.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-web.
