PT-2025-17573 · Jmix · Jmix

Knstvk · Published 2024-10-24 · Updated 2025-12-31 · CVE-2025-32951

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jmix versions 1.0.0 through 1.6.1 Jmix versions 2.0.0 through 2.3.4

Description The issue affects Jmix, a set of libraries and tools for Spring Boot data-centric application development. It allows manipulation of the input parameter, which consists of a file path and name, to return the Content-Type header with text/html if the name part ends with .html. This could enable malicious JavaScript code to be executed in the browser. A successful attack requires a malicious file to be uploaded beforehand.

Recommendations For versions 1.0.0 through 1.6.1, update to version 1.6.2. For versions 2.0.0 through 2.3.4, update to version 2.4.0. As a temporary workaround, consider using the workaround provided on the Jmix documentation website.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-13809

CVE-2025-32951

GHSA-X27V-F838-JH93

Affected Products

Jmix

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32951.json · Exploit
• https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa · Patch
• https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a · Patch
• https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93 · Vendor Advisory
• https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2 · Patch
• https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37 · Patch
• https://docs.jmix.io/jmix/files-vulnerabilities.html · Vendor Advisory
• https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x27v-f838-jh93 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13809 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32951 · Security Note
• https://github.com/jmix-framework/jmix/issues/3836 · Note
• https://github.com/jmix-framework/jmix/issues/3804 · Note
• https://github.com/jmix-framework/jmix · Note