CVE-2026-120326 | Vaadin Flow DownloadEvent DownloadEvent.setFileName fileName injection

A vulnerability was found in Vaadin Flow. It has been classified as problematic. Affected is the function DownloadEvent.setFileName of the component DownloadEvent. Performing a manipulation of the argument fileName results in injection.

This vulnerability is identified as CVE-2026-120326. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More