PT-2025-17576 · Unknown · Cuba Rest Api Add-On

Lowknstvk · Published 2025-04-22 · Updated 2025-04-23 · CVE-2025-32960

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CUBA REST API add-on versions prior to 7.2.7

Description The issue allows malicious JavaScript code to be executed in the browser by manipulating the input parameter, which consists of a file path and name, to return the Content-Type header with text/html if the name part ends with .html. This requires a malicious file to be uploaded beforehand.

Recommendations For versions prior to 7.2.7, update to version 7.2.7 to resolve the issue. As a temporary workaround, consider using the workaround provided on the Jmix documentation website until the update to version 7.2.7 can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-32960

GHSA-88H5-34XW-2Q56

GHSA-X27V-F838-JH93

Affected Products

Cuba Rest Api Add-On

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32960.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-32960 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x27v-f838-jh93 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-88h5-34xw-2q56 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32951 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-32960 · Security Note
• https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93 · Note
• https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a · Note
• https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2 · Note
• https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37 · Note
• https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa · Note
• https://github.com/jmix-framework/jmix/issues/3804 · Note
• https://github.com/jmix-framework/jmix/issues/3836 · Note
• https://github.com/jmix-framework/jmix · Note
• https://github.com/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1 · Note