PT-2025-17574 · Jmix · Jmix

Knstvk · Published 2025-04-22 · Updated 2025-12-31 · CVE-2025-32952

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Jmix versions 1.0.0 through 1.6.1 Jmix versions 2.0.0 through 2.3.4

Description The local file storage implementation in Jmix does not restrict the size of uploaded files, allowing an attacker to upload excessively large files and potentially cause the server to run out of space, resulting in a denial of service.

Recommendations For versions 1.0.0 through 1.6.1, update to version 1.6.2. For versions 2.0.0 through 2.3.4, update to version 2.4.0. As a temporary workaround, consider restricting the size of uploaded files to prevent excessive file uploads until a patch is applied.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-06373

CVE-2025-32952

GHSA-F3GV-CWWH-758M

Affected Products

Jmix

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32952.json · Exploit
• https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m · Vendor Advisory
• https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa · Patch
• https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a · Patch
• https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2 · Patch
• https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37 · Patch
• https://docs.jmix.io/jmix/files-vulnerabilities.html · Vendor Advisory
• https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32952 · Security Note
• https://osv.dev/vulnerability/GHSA-f3gv-cwwh-758m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32952 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06373 · Security Note
• https://github.com/jmix-framework/jmix/issues/3804 · Note
• https://github.com/jmix-framework/jmix/issues/3836 · Note
• https://github.com/jmix-framework/jmix · Note