CVE-2025-9467: Vaadin Framework possible file bypass via upload validation on the server-side

The vulnerability is a race condition in the file upload mechanism. The provided patch from commit bfe9e507cdcc5d90a2312c8f0162f798a29ba635 clearly shows the fix. The endUpload method in com.vaadin.flow.component.upload.Upload is modified to only reset the interrupted flag when all active uploads are complete (activeUploads == 0). Previously, it was reset after every single upload, creating a window where a file validation failure that should interrupt all uploads could be ignored for other files in the same batch. An attacker could exploit this by sending a batch of files where the first one triggers a validation error and an interruption, but a subsequent malicious file gets processed because the interruption is prematurely cleared. While the security advisory refers to older vaadin-server packages, the provided commit is for the newer vaadin-flow-components. The fundamental logic of the vulnerability is the same, and the endUpload function is the core of the flawed implementation.