Is CVE-2026-120326 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120326 being exploited in the wild.

How severe is CVE-2026-120326?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Vaadin Flow 24.8.0 - 24.8.17, 24.9.0 - 24.9.25, 24.10.0 - 24.10.13, 25.0.0 - 25.0.13, 25.1.0 - 25.1.13, 25.2.0 - 25.2.12, 25.3.0 - 25.3.4.

Is there a fix for CVE-2026-120326?

Yes: fixed in Vaadin Flow 24.9.26, 24.10.14, 25.2.13, 25.3.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120326 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120326?

Check whether you run Vaadin Flow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120326: Vaadin Flow unescaped Content-Disposition header injection

CVE-2026-120326 · Severity: info · Published 2026-11-10

Vaadin Flow, a Java web framework for building interactive applications, improperly handles file names in download responses. An attacker who can control the file name passed to download methods can inject extra parameters into the HTTP header that causes browsers to save files under a different name and extension than intended, bypassing file type restrictions implemented by the application.

Vendors: Vaadin.

Quick answers

Is CVE-2026-120326 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120326 being exploited in the wild.
How severe is CVE-2026-120326?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Vaadin Flow 24.8.0 - 24.8.17, 24.9.0 - 24.9.25, 24.10.0 - 24.10.13, 25.0.0 - 25.0.13, 25.1.0 - 25.1.13, 25.2.0 - 25.2.12, 25.3.0 - 25.3.4.
Is there a fix for CVE-2026-120326?: Yes: fixed in Vaadin Flow 24.9.26, 24.10.14, 25.2.13, 25.3.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120326 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120326?: Check whether you run Vaadin Flow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Vaadin Flow 24.9.26, 24.10.14, 25.2.13, 25.3.5

Technical details

The DownloadEvent.setFileName() and inline() methods in Vaadin Flow insert file names verbatim into the Content-Disposition HTTP header without escaping special characters. An attacker can inject a double-quote character to close the filename parameter early and add a filename* parameter, which modern browsers prefer over the standard filename parameter. The vulnerability requires the application to pass untrusted file names to these methods, and the attacker cannot change the disposition type itself.

Affected products

Vaadin Flow 24.8.0 - 24.8.17, 24.9.0 - 24.9.25, 24.10.0 - 24.10.13, 25.0.0 - 25.0.13, 25.1.0 - 25.1.13, 25.2.0 - 25.2.12, 25.3.0 - 25.3.4

Timeline

2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.