What is CVE-2025-15022?

CVE-2025-15022 is a medium-severity cross-site scripting (XSS) vulnerability in com.vaadin:vaadin-server (maven), affecting versions >= 7.0.0, < 7.7.50. It is fixed in 7.7.50, 8.30.0, 23.6.6, 24.8.14, 24.9.7. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.

Which packages are affected by CVE-2025-15022?

com.vaadin:vaadin-server (maven) versions >= 7.0.0, = 23.1.0, = 23.1.0, < 23.6.6.

Is there a fix for CVE-2025-15022?

Yes. CVE-2025-15022 is fixed in 7.7.50, 8.30.0, 23.6.6, 24.8.14, 24.9.7. Upgrade to this version or later.

Is CVE-2025-15022 exploitable, and should I be worried?

Whether CVE-2025-15022 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2025-15022 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2025-15022 in com.vaadin:vaadin-server

Q: Which packages are affected by CVE-2025-15022?

com.vaadin:vaadin-server (maven) versions >= 7.0.0, = 23.1.0, = 23.1.0, < 23.6.6.

Q: Is there a fix for CVE-2025-15022?

Yes. CVE-2025-15022 is fixed in 7.7.50, 8.30.0, 23.6.6, 24.8.14, 24.9.7. Upgrade to this version or later.

Q: Is CVE-2025-15022 exploitable, and should I be worried?

Whether CVE-2025-15022 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2025-15022 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2025-15022?

Upgrade: com.vaadin:vaadin-server to 7.7.50 or later, com.vaadin:vaadin-server to 8.30.0 or later, com.vaadin:vaadin to 23.6.6 or later, com.vaadin:vaadin to 24.8.14 or later, com.vaadin:vaadin to 24.9.7 or later, com.vaadin:vaadin-spreadsheet-flow to 23.6.6 or later, com.vaadin:vaadin-spreadsheet-flow to 24.8.14 or later, com.vaadin:vaadin-spreadsheet-flow to 24.9.7 or later.

Summary

Vaadin vulnerable to Cross-site Scripting

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input.

In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility.

In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist.

Vaadin 14 is not affected as Spreadsheet component was not supported.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version
Vaadin 7.0.0 - 7.7.49
Vaadin 8.0.0 - 8.29.1
Vaadin 23.1.0 - 23.6.5
Vaadin 24.0.0 - 24.8.13
Vaadin 24.9.0 - 24.9.6

Mitigation
Upgrade to 7.7.50
Upgrade to 8.30.0
Upgrade to 23.6.6
Upgrade to 24.8.14 or 24.9.7
Upgrade to 25.0.0 or newer

Artifacts Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server
7.0.0 - 7.7.49
≥7.7.50
com.vaadin:vaadin-server
8.0.0 - 8.29.1
≥8.30.0
com.vaadin:vaadin
23.1.0 - 23.6.5
≥23.6.6
com.vaadin:vaadin24.0.0 - 24.8.13
≥24.8.14
com.vaadin:vaadin24.9.0 - 24.9.6
≥24.9.7
com.vaadin:vaadin-spreadsheet-flow
23.1.0 - 23.6.5
≥23.6.6
com.vaadin:vaadin-spreadsheet-flow
24.0.0 - 24.8.13
≥24.8.14
com.vaadin:vaadin-spreadsheet-flow
24.9.0 - 24.9.6
≥24.9.7

Impact

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

Affected versions

com.vaadin:vaadin-server (>= 7.0.0, < 7.7.50) com.vaadin:vaadin-server (>= 8.0.0, < 8.30.0) com.vaadin:vaadin (>= 23.1.0, < 23.6.6) com.vaadin:vaadin (>= 24.0.0, < 24.8.14) com.vaadin:vaadin (>= 24.9.0, < 24.9.7) com.vaadin:vaadin-spreadsheet-flow (>= 23.1.0, < 23.6.6) com.vaadin:vaadin-spreadsheet-flow (>= 24.0.0, < 24.8.14) com.vaadin:vaadin-spreadsheet-flow (>= 24.9.0, < 24.9.7)

Security releases

com.vaadin:vaadin-server → 7.7.50 (maven) com.vaadin:vaadin-server → 8.30.0 (maven) com.vaadin:vaadin → 23.6.6 (maven) com.vaadin:vaadin → 24.8.14 (maven) com.vaadin:vaadin → 24.9.7 (maven) com.vaadin:vaadin-spreadsheet-flow → 23.6.6 (maven) com.vaadin:vaadin-spreadsheet-flow → 24.8.14 (maven) com.vaadin:vaadin-spreadsheet-flow → 24.9.7 (maven)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade the following packages to resolve this vulnerability:

com.vaadin:vaadin-server to 7.7.50 or later; com.vaadin:vaadin-server to 8.30.0 or later; com.vaadin:vaadin to 23.6.6 or later; com.vaadin:vaadin to 24.8.14 or later; com.vaadin:vaadin to 24.9.7 or later; com.vaadin:vaadin-spreadsheet-flow to 23.6.6 or later; com.vaadin:vaadin-spreadsheet-flow to 24.8.14 or later; com.vaadin:vaadin-spreadsheet-flow to 24.9.7 or later

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2025-15022? CVE-2025-15022 is a medium-severity cross-site scripting (XSS) vulnerability in com.vaadin:vaadin-server (maven), affecting versions >= 7.0.0, < 7.7.50. It is fixed in 7.7.50, 8.30.0, 23.6.6, 24.8.14, 24.9.7. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
Which packages are affected by CVE-2025-15022?
- com.vaadin:vaadin-server (maven) (versions >= 7.0.0, < 7.7.50)
- com.vaadin:vaadin (maven) (versions >= 23.1.0, < 23.6.6)
- com.vaadin:vaadin-spreadsheet-flow (maven) (versions >= 23.1.0, < 23.6.6)
Is there a fix for CVE-2025-15022? Yes. CVE-2025-15022 is fixed in 7.7.50, 8.30.0, 23.6.6, 24.8.14, 24.9.7. Upgrade to this version or later.
Is CVE-2025-15022 exploitable, and should I be worried? Whether CVE-2025-15022 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2025-15022 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2025-15022?
- Upgrade com.vaadin:vaadin-server to 7.7.50 or later
- Upgrade com.vaadin:vaadin-server to 8.30.0 or later
- Upgrade com.vaadin:vaadin to 23.6.6 or later
- Upgrade com.vaadin:vaadin to 24.8.14 or later
- Upgrade com.vaadin:vaadin to 24.9.7 or later
- Upgrade com.vaadin:vaadin-spreadsheet-flow to 23.6.6 or later
- Upgrade com.vaadin:vaadin-spreadsheet-flow to 24.8.14 or later
- Upgrade com.vaadin:vaadin-spreadsheet-flow to 24.9.7 or later

Other vulnerabilities in com.vaadin:vaadin-server

CVE-IDSeverityPackage summary

CVE-2025-9467Mediumcom.vaadin:vaadin-server: Vaadin Framework possible file bypass via upload validation on the server-side GHSA-J23J-Q57M-63V3Mediumcom.vaadin:vaadin-server: Denial of service in DataCommunicator class in Vaadin 8 CVE-2021-33609Mediumcom.vaadin:vaadin-server: Denial of service in DataCommunicator class in Vaadin 8 CVE-2021-31403Mediumcom.vaadin:vaadin-bom: Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8 CVE-2019-25028Mediumcom.vaadin:vaadin-bom: Stored cross-site scripting in Grid component in Vaadin 7 and 8