CUBA Vulnerable to Denial of Service (DoS) in the File Storage
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in version 7.2.23. A workaround is provided on the Jmix documentation website.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cuba-platform | cuba | before 7.2.23 | 7.2.23 | Patch available | CNA |
| — | com.haulmont.cuba:cuba-core (Maven) | before 7.2.23 | 7.2.23 | Patch available | GHSA-w3mp-6vrj-875g |
- cuba Vendorcuba-platform Affected before 7.2.23 Fixed in 7.2.23 Patch available CNA
- com.haulmont.cuba:cuba-core (Maven) Vendor— Affected before 7.2.23 Fixed in 7.2.23 Patch available GHSA-w3mp-6vrj-875g
Remediation
- Fix · CNA cuba (cuba-platform) Fixed in 7.2.23
- Fix · GHSA-w3mp-6vrj-875g com.haulmont.cuba:cuba-core (Maven) Fixed in 7.2.23 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-32959
- 2026-10-03 Alias added: GHSA-w3mp-6vrj-875g
References
Other 6
- https://github.com/cuba-platform/cuba/security/advisories/GHSA-w3mp-6vrj-875g
- https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m
- https://github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1
- https://docs.jmix.io/jmix/files-vulnerabilities.html
- https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application
- https://github.com/cuba-platform/cuba
More cuba-platform vulnerabilities
- TI-2025-23971 CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpoint CVSS 3.1MEDIUM 6.4
- TI-2025-23970 CUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files Endpoint CVSS 3.1MEDIUM 6.4
Sources
- CVE-2025-32959 · CVE Program
- CVE-2025-32959 · NVD
- FIRST EPSS
- GHSA-w3mp-6vrj-875g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences