GHSA-8wx2-9q48-vm9r
GitHub Security Advisory
RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Affected Packages
Maven
org.springframework:spring-webmvc
Affected versions:
5.2.0.RELEASE
(fixed in 5.2.3.RELEASE)
Maven
org.springframework:spring-webmvc
Affected versions:
5.1.0.RELEASE
(fixed in 5.1.13.RELEASE)
Maven
org.springframework:spring-webmvc
Affected versions:
5.0.0.RELEASE
(fixed in 5.0.16.RELEASE)
Maven
org.springframework:spring-webflux
Affected versions:
5.2.0.RELEASE
(fixed in 5.2.3.RELEASE)
Maven
org.springframework:spring-webflux
Affected versions:
5.1.0.RELEASE
(fixed in 5.1.13.RELEASE)
Maven
org.springframework:spring-webflux
Affected versions:
5.0.0.RELEASE
(fixed in 5.0.16.RELEASE)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: September 19, 2025 6:29 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.