CVE-2025-41234: Spring Framework Vulnerability Enables Reflected File Download Attacks

The Spring project has released a security advisory disclosing a vulnerability in the popular Spring Framework, which could allow attackers to launch Reflected File Download (RFD) attacks under certain conditions. Tracked as CVE-2025-41234 and rated CVSS 6.5 (Medium), the flaw impacts Spring Framework versions across the 6.0, 6.1, and 6.2 branches.

“An application is vulnerable to a reflected file download (RFD) attack when it sets a Content-Disposition header with a non-ASCII charset, where the filename attribute is derived from user-supplied input,” the advisory explains.

Reflected File Download (RFD) is a lesser-known but dangerous technique in which an attacker tricks a user’s browser into downloading a malicious file with a deceptive name and executable content, leveraging improperly set HTTP headers.

CVE-2025-41234 affects Spring Framework applications that meet all of the following criteria:

• Use org.springframework.http.ContentDisposition to prepare the Content-Disposition header.
• Set the filename using ContentDisposition.Builder#filename(String, Charset) with a non-ASCII charset.
• Derive the filename from unsanitized user input.
• Include malicious content in the downloaded response.

“The downloaded content of the response is injected with malicious commands by the attacker,” the advisory notes.

Your application is not vulnerable if:

• You do not set a Content-Disposition header at all.
• You do not use the Spring ContentDisposition builder.
• You use filename(String) or filename(String, ASCII) instead of the affected method.
• You sanitize the filename before use.
• The attacker cannot inject malicious content into the downloaded response.

These safeguards effectively break the RFD attack chain.

The vulnerability impacts the following versions of the Spring Framework:

“Older, unsupported versions are not affected,” according to the advisory.

Related Posts:

• Spring Framework Multiple Security Vulnerability
• Palo Alto Networks Warns of XSS Flaw with PoC Exploit Code
• Spring Framework Flaw Allows Unauthorized Access via Security Bypass
• Flaw in Ghostscript Could Allow Command Execution
• Mitel Issues Critical Fixes for XSS Vulnerabilities in MiContact Center Business

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.