CVE-2025-32960 json
CUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files Endpoint
published 2025-04-22 18 mo ago modified 2026-06-17 4 mo ago also GHSA-88h5-34xw-2q56 , EUVD-2025-12221
- cvss
- 6.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website.
Patch / fix
- maven com.haulmont.addon.restapi:restapi-rest-api 7.2.7
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.haulmont.addon.restapi:restapi-rest-api | <7.2.7 |
7.2.7 |
Affected products
- cuba-platform restapi
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1
web
-
github.com
/cuba-platform/restapi/security/advisories/GHSA-88h5-34xw-2q56
web
-
github.com
/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93
web
-
docs.jmix.io
/jmix/files-vulnerabilities.html
web
-
docs.jmix.io
/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-32960
advisory
-
github.com
/cuba-platform/restapi
package
Sources
- CVE List CVE-2025-32960
- GitHub Advisory GHSA-88h5-34xw-2q56
- NVD CVE-2025-32960
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.