PT-2025-17559 · Jmix · Jmix

Shadowsock5 · Published 2025-04-22 · Updated 2025-12-31 · CVE-2025-32950

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jmix versions 1.0.0 through 1.6.1 Jmix versions 2.0.0 through 2.3.4

Description The issue allows attackers to manipulate the fileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the "/files" endpoint of the generic REST API.

Recommendations For versions 1.0.0 through 1.6.1, update to version 1.6.2. For versions 2.0.0 through 2.3.4, update to version 2.4.0. As a temporary workaround, consider restricting access to the /files endpoint of the generic REST API until a patch is available. Avoid using harmful values in the fileRef parameter until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-35

Related Identifiers

CVE-2025-32950

GHSA-JX4G-3XQM-62VH

Affected Products

Jmix

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32950.json · Exploit
• https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2 · Patch
• https://github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vh · Vendor Advisory
• https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a · Patch
• https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37 · Patch
• https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-32950 · Security Note
• https://osv.dev/vulnerability/GHSA-jx4g-3xqm-62vh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32950 · Vendor Advisory
• https://docs.jmix.io/jmix/files-vulnerabilities.html#fix-path-traversal-in-jmix-application · Vendor Advisory
• https://docs.jmix.io/jmix/files-vulnerabilities.html · Vendor Advisory
• https://github.com/jmix-framework/jmix/issues/3804 · Note
• https://github.com/jmix-framework/jmix/issues/3836 · Note
• https://github.com/jmix-framework/jmix · Note
• https://twitter.com/VulmonFeeds/status/1914808090207175017 · Twitter Post