Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware’s Spring Framework has been patched, affecting multiple versions of the widely used Java framework.

The flaw enables attackers to execute malicious code by exploiting improperly configured Content-Disposition headers in a web application.

Technical Breakdown

The vulnerability arises when applications use Spring’s org.springframework.http.ContentDisposition class to set filenames with non-ASCII characters derived from unsanitized user input.

Attackers can craft HTTP responses that trick users into downloading files with executable extensions (e.g., .cmd, .bat) containing malicious commands.

Vulnerable Code Pattern

java// UNSAFE: Uses non-ASCII charset with user-supplied input
ContentDisposition.builder("attachment")
    .filename(userInput, StandardCharsets.UTF_8)  // Non-ASCII charset
    .build();

Safe Alternatives

java// SAFE: Uses ASCII charset
ContentDisposition.builder("attachment")
    .filename(userInput, StandardCharsets.US_ASCII)  // ASCII restriction
    .build();

// SAFE: Sanitizes input
String sanitized = FilenameUtils.sanitize(userInput);
ContentDisposition.builder("attachment")
    .filename(sanitized, StandardCharsets.UTF_8)
    .build();

Risk Analysis

The vulnerability scores a CVSS 6.8 (Medium) due to its reliance on user interaction and contextual scope changes.

Successful exploitation requires:

1. A victim downloading a file from a malicious link
2. The filename containing executable extensions
3. The response body includes attacker-controlled commands.

Affected Versions and Mitigation

Impacted Releases

• Spring Framework 6.2.0–6.2.7
• Spring Framework 6.1.0–6.1.20
• Spring Framework 6.0.5–6.0.28 (Commercial)

Patched Versions

VMware recommends immediate upgrades for open-source users. Commercial customers using Spring Boot 3.1/3.2 should apply hotfixes 3.1.17.1 or 3.2.15.1.

Applications are not vulnerable if they:

• Avoid setting Content-Disposition headers
• Use filename(String) instead of charset-specific methods
• Sanitize filenames using libraries like Apache Commons IO FilenameUtils.

Industry Response

The Spring team released patches within 24 hours of disclosure, with coordinated updates across:

• Spring Framework 6.1.21 (final OSS release for 6.1.x)
• Spring Framework 6.2.8 (39 fixes total)
• Commercial backports for enterprises.

Security researcher Jakob Linskeseder of Dynatrace identified the flaw, highlighting continued risks in header manipulation attacks.

This follows recent vulnerabilities in Microsoft Outlook (CVE-2025-47176) and Windows Secure Boot (CVE-2025-3052), underscoring the need for rigorous input validation.

Conclusion

CVE-2025-41234 demonstrates how subtle API misuse in popular frameworks can create enterprise-wide risks.

Developers using Spring’s ContentDisposition The builder should immediately:

1. Upgrade to patched versions
2. Audit filename handling workflows
3. Implement whitelists for allowed charsets

While the attack requires specific preconditions, its potential for client-side code execution warrants prioritization in web application security protocols.