TI-2020-18604 Aliases CVE-2020-36321 GHSA-49r2-73m6-pp8f

Directory traversal in development mode handler in Vaadin 14 and 15-17

LOW 35CWE-22Published 2021-04-23 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

Why it matters now

EPSS 0.01211 68th percentileScored 2026-11-07

Fix Fixed com.vaadin:flow-server (Maven): 5.0.0, 2.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Vaadin	Vaadin	14.0.0 and later	—	No fix listed	CNA
Vaadin	flow-server	2.0.0 and later	—	No fix listed	CNA
—	com.vaadin:flow-server (Maven)	3.0.0 to before 5.0.0	5.0.0	Patch available	GHSA-49r2-73m6-pp8f
—	com.vaadin:flow-server (Maven)	2.0.0 to before 2.4.2	2.4.2	Patch available	GHSA-49r2-73m6-pp8f

Vaadin VendorVaadin Affected 14.0.0 and later Fixed in — No fix listed CNA
flow-server VendorVaadin Affected 2.0.0 and later Fixed in — No fix listed CNA
com.vaadin:flow-server (Maven) Vendor— Affected 3.0.0 to before 5.0.0 Fixed in 5.0.0 Patch available GHSA-49r2-73m6-pp8f
com.vaadin:flow-server (Maven) Vendor— Affected 2.0.0 to before 2.4.2 Fixed in 2.4.2 Patch available GHSA-49r2-73m6-pp8f

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:vaadin:flow::::::::	2.0.0 to before 2.4.2; 3.0.0 to before 5.0.0	Vulnerable	Vaadin
cpe:2.3:a:vaadin:vaadin::::::::	14.0.0 to before 14.4.3; 15.0.0 to before 18.0.0	Vulnerable	Vaadin

cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.4.2; 3.0.0 to before 5.0.0 Vulnerable ·Vaadin
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 14.0.0 to before 14.4.3; 15.0.0 to before 18.0.0 Vulnerable ·Vaadin

Remediation

Fix · GHSA-49r2-73m6-pp8f com.vaadin:flow-server (Maven) Fixed in 5.0.0 Advisory →
Fix · GHSA-49r2-73m6-pp8f com.vaadin:flow-server (Maven) Fixed in 2.4.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-36321
2026-10-03 Alias added: GHSA-49r2-73m6-pp8f

References

Patch 1

https://github.com/vaadin/flow/pull/9392

Advisory 2

Other 1

https://github.com/vaadin/flow/security/advisories/GHSA-49r2-73m6-pp8f

TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
TI-2021-11543 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVSS 3.1HIGH 7.8
TI-2021-11540 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.1
TI-2020-18602 Potential sensitive data exposure in applications using Vaadin 15 CVSS 3.1MEDIUM 6.5
TI-2019-15167 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 CVSS 3.1MEDIUM 6.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences