Read the docs
TI-2025-23962 Aliases CVE-2025-32951GHSA-x27v-f838-jh93

io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed jmix (jmix-framework): 1.6.2, 2.4.0io.jmix.rest:jmix-rest (Maven): 1.6.2, 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jmix-frameworkjmix1.0.0 to before 1.6.2; 2.0.0 to before 2.4.01.6.2, 2.4.0Patch availableCNA
—io.jmix.rest:jmix-rest (Maven)1.0.0 to before 1.6.21.6.2Patch availableGHSA-x27v-f838-jh93
—io.jmix.rest:jmix-rest (Maven)2.0.0 to before 2.4.02.4.0Patch availableGHSA-x27v-f838-jh93
  • jmix Vendorjmix-framework Affected 1.0.0 to before 1.6.2; 2.0.0 to before 2.4.0 Fixed in 1.6.2, 2.4.0 Patch available CNA
  • io.jmix.rest:jmix-rest (Maven) Vendor— Affected 1.0.0 to before 1.6.2 Fixed in 1.6.2 Patch available GHSA-x27v-f838-jh93
  • io.jmix.rest:jmix-rest (Maven) Vendor— Affected 2.0.0 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-x27v-f838-jh93

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:haulmont:cuba_platform:*:*:*:*:*:*:*:*6.2.0 to before 7.2.23Vulnerablejmix-framework
cpe:2.3:a:haulmont:cuba_rest_api:*:*:*:*:*:*:*:*7.1.1 to before 7.2.7Vulnerablejmix-framework
cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*1.0.0 to before 1.6.2; 2.0.0 to before 2.4.0Vulnerablejmix-framework
cpe:2.3:a:haulmont:jpa_web_api:*:*:*:*:*:*:*:*1.0.0 to before 1.1.1Vulnerablejmix-framework
  • cpe:2.3:a:haulmont:cuba_platform:*:*:*:*:*:*:*:* Versions 6.2.0 to before 7.2.23 Vulnerable ·jmix-framework
  • cpe:2.3:a:haulmont:cuba_rest_api:*:*:*:*:*:*:*:* Versions 7.1.1 to before 7.2.7 Vulnerable ·jmix-framework
  • cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.6.2; 2.0.0 to before 2.4.0 Vulnerable ·jmix-framework
  • cpe:2.3:a:haulmont:jpa_web_api:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.1.1 Vulnerable ·jmix-framework

Remediation

  • Fix · CNA jmix (jmix-framework) Fixed in 1.6.2, 2.4.0
  • Fix · GHSA-x27v-f838-jh93 io.jmix.rest:jmix-rest (Maven) Fixed in 1.6.2 Advisory →
  • Fix · GHSA-x27v-f838-jh93 io.jmix.rest:jmix-rest (Maven) Fixed in 2.4.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32951
  2. 2026-10-03 Alias added: GHSA-x27v-f838-jh93

References

Patch 5

Advisory 3

Other 3

  • TI-2025-23963 io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage CVSS 3.1MEDIUM 6.5
  • TI-2018-14674 The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through… CVSS 3.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences