Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an application is vulnerable when all the following are true: * The header is prepared with org.springframework.http.ContentDisposition. * The filename is set via ContentDisposition.Builder#filename(String, Charset). * The value for the filename is derived from user-supplied input. * The application does not sanitize the user-supplied input. * The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details). An application is not vulnerable if any of the following is true: * The application does not set a “Content-Disposition” response header. * The header is not prepared with org.springframework.http.ContentDisposition. * The filename is set via one of: * ContentDisposition.Builder#filename(String), or * ContentDisposition.Builder#filename(String, ASCII) * The filename is not derived from user-supplied input. * The filename is derived from user-supplied input but sanitized by the application. * The attacker cannot inject malicious content in the downloaded content of the response. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.7 * 6.1.0 - 6.1.20 * 6.0.5 - 6.0.28 * Older, unsupported versions are not affected MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CWE-113 in `Content-Disposition` handling in VMware Spring Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII charsets.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is
    vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a
    non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an
    application is vulnerable when all the following are true: * The header is prepared with
    org.springframework.http.ContentDisposition. * The filename is set via
    ContentDisposition.Builder#filename(String, Charset). * The value for the filename is derived from user-
    supplied input. * The application does not sanitize the user-supplied input. * The downloaded content of
    the response is injected with malicious commands by the attacker (see RFD paper reference for details). An
    application is not vulnerable if any of the following is true: * The application does not set a “Content-
    Disposition” response header. * The header is not prepared with
    org.springframework.http.ContentDisposition. * The filename is set via one of: *
    ContentDisposition.Builder#filename(String), or * ContentDisposition.Builder#filename(String, ASCII) * The
    filename is not derived from user-supplied input. * The filename is derived from user-supplied input but
    sanitized by the application. * The attacker cannot inject malicious content in the downloaded content of
    the response. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.7 * 6.1.0 - 6.1.20 *
    6.0.5 - 6.0.28 * Older, unsupported versions are not affected MitigationUsers of affected versions should
    upgrade to the corresponding fixed version. Affected version(s)Fix
    versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No
    further mitigation steps are necessary. CWE-113 in `Content-Disposition` handling in VMware Spring
    Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks
    via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII
    charsets. (CVE-2025-41234)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is     vulnerable to a reflected file download (RFD) attack when it sets a Content-Disposition header with a     non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an     application is vulnerable when all the following are true: * The header is prepared with     org.springframework.http.ContentDisposition. * The filename is set via     ContentDisposition.Builder#filename(String, Charset). * The value for the filename is derived from user-     supplied input. * The application does not sanitize the user-supplied input. * The downloaded content of     the response is injected with malicious commands by the attacker (see RFD paper reference for details). An     application is not vulnerable if any of the following is true: * The application does not set a Content-     Disposition response header. * The header is not prepared with     org.springframework.http.ContentDisposition. * The filename is set via one of: *     ContentDisposition.Builder#filename(String), or * ContentDisposition.Builder#filename(String, ASCII) * The     filename is not derived from user-supplied input. * The filename is derived from user-supplied input but     sanitized by the application. * The attacker cannot inject malicious content in the downloaded content of     the response. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.7 * 6.1.0 - 6.1.20 *     6.0.5 - 6.0.28 * Older, unsupported versions are not affected MitigationUsers of affected versions should     upgrade to the corresponding fixed version. Affected version(s)Fix     versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No     further mitigation steps are necessary. CWE-113 in `Content-Disposition` handling in VMware Spring     Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks     via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII     charsets. (CVE-2025-41234)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Spring Framework installed on the remote host is 6.0.5 prior to 6.0.29, 6.1.x prior to 6.1.21, or 6.2.x prior to 6.2.8. It is, therefore, affected by a reflected file download vulnerability:

  - In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a     reflected file download (RFD) attack when it sets a 'Content-Disposition' header with a non-ASCII charset, where the     filename attribute is derived from user-supplied input. (CVE-2025-41234)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
459370	Echo: org.springframework:spring-web: security update to 6.1.21	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459370	Echo: org.springframework:spring-web: security update to 6.1.21	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
251364	Linux Distros Unpatched Vulnerability : CVE-2025-41234	Nessus	Misc.	Local	medium
240742	Spring Framework 6.0.5 < 6.0.29 / 6.1.x < 6.1.21 / 6.2.x < 6.2.8 Reflected File Download (CVE-2025-41234)	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-41234

medium

Tenable Plugins

medium

medium

medium

medium