%20(1).webp "Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header")
A new medium-severity vulnerability (CVE-2025-41234) in VMware’s Spring Framework enables remote attackers to execute malicious code through manipulated Content-Disposition headers. Immediate updates and input sanitization are recommended to mitigate this risk. #SpringFramework #ContentDisposition
Keypoints
- The vulnerability affects multiple versions of VMware’s Spring Framework, including 6.2.0–6.2.7 and 6.1.0–6.1.20.
- Attackers can craft HTTP responses with filenames containing executable extensions to trick users into downloading malicious files.
- Exploitation requires user interaction, such as downloading a file from a malicious link.
- Developers should avoid setting Content-Disposition headers with non-ASCII characters and sanitize filenames to prevent risks.
- VMware and Spring team issued patches rapidly, with recommended upgrades for affected versions to mitigate exploitation.
Read More: https://gbhackers.com/spring-framework-flaw/