CVE-2025-32950
- Source
- https://cve.org/CVERecord?id=CVE-2025-32950
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32950.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-32950
- Aliases
- Published
- 2025-04-22T17:14:43.211Z
- Modified
- 2026-07-22T04:01:55.115047Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage
- Details
-
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the
/filesendpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website. - Database specific
{ "cwe_ids": [ "CWE-22", "CWE-35" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32950.json" }- References
-
- https://docs.jmix.io/jmix/files-vulnerabilities.html
- https://docs.jmix.io/jmix/files-vulnerabilities.html#fix-path-traversal-in-jmix-application
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32950.json
- https://github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vh
- https://nvd.nist.gov/vuln/detail/CVE-2025-32950
- https://github.com/jmix-framework/jmix/issues/3804
- https://github.com/jmix-framework/jmix/issues/3836
- https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2
- https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a
- https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37
- https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa
Affected packages
Git / github.com/jmix-framework/jmix
Affected ranges
- Type
- GIT
- Repo
- https://github.com/jmix-framework/jmix
- Events
-
IntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
{ "source": [ "CPE_RANGE", "REFERENCES" ], "cpe": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "1.0.0" }, { "fixed": "1.6.2" }, { "introduced": "2.0.0" }, { "fixed": "2.4.0" } ] }
Database specific
vanir_signatures
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"257171504550285267212676293078898244411",
"330252577252064265692050387820904146178",
"12650619012565884244224958336166979861",
"129596914928252030239937601749259738742",
"102196870620493586893219714788609534690",
"29550115576375924630979617626519005065",
"80829210826843167460847408781757785315",
"4075255561379606518122893872180690975",
"270153682905755326338333752175833973540",
"138185996710290724794266332406947486828",
"217358883921368263473167424924575254320",
"271004535290349167646172721381770911034",
"216091253615713313282810904087938490639",
"22007346429263149104253509633388037034",
"22918335145885140022717251558228717629",
"97362543980323843969399682271276850524",
"240323595645474080614129767220039917292",
"293583394775211298780264717788344661250",
"198266851708669461775492812829490156780",
"196165914044214810776678707306242521826",
"45967528027294410932168743453898414217",
"195489255384344317534048952551630498858",
"252891090057982041338947245275773802846",
"96032347955747614708410141219293359995",
"35354938372743736264646197283112825341",
"174600520554897195920480439443717874439"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
"signature_type": "Line",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-01f3e4a1"
},
{
"digest": {
"length": 729.0,
"function_hash": "237488192097561257452297183120032227942"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
"signature_type": "Function",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java",
"function": "openStream"
},
"signature_version": "v1",
"id": "CVE-2025-32950-067f2269"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"241990925233922225142782538147660768828",
"64319472664298954843820160959468381720",
"168332195582017150056419384857399325705",
"132431005737998996803440318592634249148",
"79012308002042607670485717261388907055",
"203231841543963653826075079096711956903",
"103678118652843741152354719962469948760",
"197153654162788015468770501236815603860",
"272902662017339521664675568965516773327",
"4350474591627366416107298296314362336",
"215021478749696396316945991585395029470",
"185450388354206726385921661974436790271",
"165224556441162197129053117928633430985",
"59798747600465045189467767377445470000",
"241163969096571285519004508546979276409",
"85960672197704603622555610117712118698",
"80846150877722837524120323387718541465",
"117835137156639979178723087693212105913",
"60536431756060661774335405013376578376",
"117910110540241473111911991261985674026",
"97771013057993428048414764299475509739"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
"signature_type": "Line",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-0690f73f"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"81429685023829092849464465262840689166",
"12650619012565884244224958336166979861",
"129596914928252030239937601749259738742",
"102196870620493586893219714788609534690",
"29550115576375924630979617626519005065",
"80829210826843167460847408781757785315",
"244607987704971196485511354475461697152",
"287505075622138383138924546360257454025",
"138185996710290724794266332406947486828",
"217358883921368263473167424924575254320",
"201848578589535708978106588930735796503",
"69523479161212366579819592710099354390",
"22007346429263149104253509633388037034",
"22918335145885140022717251558228717629",
"97362543980323843969399682271276850524",
"240323595645474080614129767220039917292",
"293583394775211298780264717788344661250",
"198266851708669461775492812829490156780",
"196165914044214810776678707306242521826",
"45967528027294410932168743453898414217",
"195489255384344317534048952551630498858",
"291237610663730303610797988415085133161",
"252891090057982041338947245275773802846",
"96032347955747614708410141219293359995",
"35354938372743736264646197283112825341",
"174600520554897195920480439443717874439"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
"signature_type": "Line",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-1819e17b"
},
{
"digest": {
"length": 1489.0,
"function_hash": "312050956198086913287366940690889687596"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
"signature_type": "Function",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java",
"function": "saveStream"
},
"signature_version": "v1",
"id": "CVE-2025-32950-198455e8"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"241990925233922225142782538147660768828",
"64319472664298954843820160959468381720",
"168332195582017150056419384857399325705",
"132431005737998996803440318592634249148",
"79012308002042607670485717261388907055",
"203231841543963653826075079096711956903",
"103678118652843741152354719962469948760",
"239360508747966428823430150290273537103",
"29697553461777364889302067164808960686",
"296539585663304255251970162957197285664",
"226568001056506152004928984460201954806",
"185450388354206726385921661974436790271",
"165224556441162197129053117928633430985",
"59798747600465045189467767377445470000",
"241163969096571285519004508546979276409",
"85960672197704603622555610117712118698",
"80846150877722837524120323387718541465",
"117835137156639979178723087693212105913",
"60536431756060661774335405013376578376",
"117910110540241473111911991261985674026",
"97771013057993428048414764299475509739"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
"signature_type": "Line",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-1d521741"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"29185659610122395313861316182551599948",
"119436868407338526164171726990700626976",
"56732596863387622848271761664889032846",
"100687685275960529984236576844682530612",
"55683657426558059997621378749665707871",
"128070580493296348325497429624999569801",
"93118132407902822467016282270837323983",
"64142084060177013999069689214690682927",
"108607330375568690630842167193530272458",
"143601983874706057949628643660203641123",
"19866045274388517000637112827861157674",
"62777374092229266011355360022044508618",
"267028523038001442400666070711576777571",
"86537435192653488410133351022916938448",
"197008865712442448675539927397486278047",
"189058080544817031185572360218574019560",
"103739642753878370504610518275801063764",
"37886385785127333521157900858077273099",
"5424672346043702730892678598506970832",
"52762115694837994875987470896107698878",
"338850284767634062493000214987035870556",
"197314703678427400962082098546842167759"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
"signature_type": "Line",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-279460ab"
},
{
"digest": {
"length": 358.0,
"function_hash": "163214687027797466334112431517158607230"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
"signature_type": "Function",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java",
"function": "RestProperties"
},
"signature_version": "v1",
"id": "CVE-2025-32950-2ba6a463"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"13932260379203073196704883315444163311",
"69666815674261712627969178036570725708",
"293451950211830567027807347306658154928",
"10037119209135023776777496697266592252",
"223948463021109568288025534070578722639",
"242449441993541853620220015725318120213",
"253233936483156682921607132573067125011",
"89073504890973492284087840584182765851",
"120241825339634219405356938809822259303",
"73537917116907822675211993185235386030"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
"signature_type": "Line",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorageProperties.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-34523557"
},
{
"digest": {
"length": 729.0,
"function_hash": "237488192097561257452297183120032227942"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
"signature_type": "Function",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java",
"function": "openStream"
},
"signature_version": "v1",
"id": "CVE-2025-32950-35023616"
},
{
"digest": {
"length": 462.0,
"function_hash": "295386357095718959976635158240553379034"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
"signature_type": "Function",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java",
"function": "downloadFile"
},
"signature_version": "v1",
"id": "CVE-2025-32950-424d5e89"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"243621013984633556091059891848285181179",
"246785585224457197296282353151658786624",
"71725855537484191423639673854242857400",
"137945141263070845544368171411948494334",
"10037119209135023776777496697266592252",
"223948463021109568288025534070578722639",
"242449441993541853620220015725318120213",
"253233936483156682921607132573067125011",
"89073504890973492284087840584182765851",
"120241825339634219405356938809822259303",
"73537917116907822675211993185235386030"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
"signature_type": "Line",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorageProperties.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-5311a5f2"
},
{
"digest": {
"length": 358.0,
"function_hash": "163214687027797466334112431517158607230"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
"signature_type": "Function",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java",
"function": "RestProperties"
},
"signature_version": "v1",
"id": "CVE-2025-32950-54c1339a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"257171504550285267212676293078898244411",
"330252577252064265692050387820904146178",
"12650619012565884244224958336166979861",
"129596914928252030239937601749259738742",
"102196870620493586893219714788609534690",
"29550115576375924630979617626519005065",
"80829210826843167460847408781757785315",
"4075255561379606518122893872180690975",
"270153682905755326338333752175833973540",
"138185996710290724794266332406947486828",
"217358883921368263473167424924575254320",
"271004535290349167646172721381770911034",
"216091253615713313282810904087938490639",
"22007346429263149104253509633388037034",
"22918335145885140022717251558228717629",
"97362543980323843969399682271276850524",
"240323595645474080614129767220039917292",
"293583394775211298780264717788344661250",
"198266851708669461775492812829490156780",
"196165914044214810776678707306242521826",
"45967528027294410932168743453898414217",
"195489255384344317534048952551630498858",
"252891090057982041338947245275773802846",
"96032347955747614708410141219293359995",
"35354938372743736264646197283112825341",
"174600520554897195920480439443717874439"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
"signature_type": "Line",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-5d87810d"
},
{
"digest": {
"length": 1489.0,
"function_hash": "312050956198086913287366940690889687596"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
"signature_type": "Function",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java",
"function": "saveStream"
},
"signature_version": "v1",
"id": "CVE-2025-32950-5d8a49dc"
},
{
"digest": {
"length": 729.0,
"function_hash": "237488192097561257452297183120032227942"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
"signature_type": "Function",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java",
"function": "openStream"
},
"signature_version": "v1",
"id": "CVE-2025-32950-6570c3f5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"243621013984633556091059891848285181179",
"246785585224457197296282353151658786624",
"71725855537484191423639673854242857400",
"137945141263070845544368171411948494334",
"10037119209135023776777496697266592252",
"223948463021109568288025534070578722639",
"242449441993541853620220015725318120213",
"253233936483156682921607132573067125011",
"89073504890973492284087840584182765851",
"120241825339634219405356938809822259303",
"73537917116907822675211993185235386030"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
"signature_type": "Line",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorageProperties.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-684891bb"
},
{
"digest": {
"length": 729.0,
"function_hash": "237488192097561257452297183120032227942"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
"signature_type": "Function",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java",
"function": "openStream"
},
"signature_version": "v1",
"id": "CVE-2025-32950-6c7bbf9a"
},
{
"digest": {
"length": 298.0,
"function_hash": "42785535343495046610402840128147299419"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
"signature_type": "Function",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java",
"function": "RestProperties"
},
"signature_version": "v1",
"id": "CVE-2025-32950-795ebc8b"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"81429685023829092849464465262840689166",
"12650619012565884244224958336166979861",
"129596914928252030239937601749259738742",
"102196870620493586893219714788609534690",
"29550115576375924630979617626519005065",
"80829210826843167460847408781757785315",
"244607987704971196485511354475461697152",
"287505075622138383138924546360257454025",
"138185996710290724794266332406947486828",
"217358883921368263473167424924575254320",
"201848578589535708978106588930735796503",
"69523479161212366579819592710099354390",
"22007346429263149104253509633388037034",
"22918335145885140022717251558228717629",
"97362543980323843969399682271276850524",
"240323595645474080614129767220039917292",
"293583394775211298780264717788344661250",
"198266851708669461775492812829490156780",
"196165914044214810776678707306242521826",
"45967528027294410932168743453898414217",
"195489255384344317534048952551630498858",
"291237610663730303610797988415085133161",
"252891090057982041338947245275773802846",
"96032347955747614708410141219293359995",
"35354938372743736264646197283112825341",
"174600520554897195920480439443717874439"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
"signature_type": "Line",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-7b8e7041"
},
{
"digest": {
"length": 298.0,
"function_hash": "42785535343495046610402840128147299419"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
"signature_type": "Function",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java",
"function": "RestProperties"
},
"signature_version": "v1",
"id": "CVE-2025-32950-83f9d368"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"117162296588913963192368785038390624568",
"307634261829362565021699109295626487122",
"196410445464845262661405074631952134675",
"120049243697650972740132314177496527555",
"128070580493296348325497429624999569801",
"198580463888025138106743828579571251842",
"301145081542719358368817073716020993005",
"301427142021224102750427708011992741204",
"19866045274388517000637112827861157674",
"262341276278426797078287369172075852027",
"269214936570555792287275253079834983838",
"89565200698860100190898665717407457897",
"189058080544817031185572360218574019560",
"103739642753878370504610518275801063764",
"37886385785127333521157900858077273099",
"5424672346043702730892678598506970832",
"17849502913531087632679325642094119449",
"323383003213751167692917648624716845922",
"197314703678427400962082098546842167759"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
"signature_type": "Line",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-8f9c2cd9"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"241990925233922225142782538147660768828",
"64319472664298954843820160959468381720",
"168332195582017150056419384857399325705",
"132431005737998996803440318592634249148",
"79012308002042607670485717261388907055",
"203231841543963653826075079096711956903",
"103678118652843741152354719962469948760",
"197153654162788015468770501236815603860",
"272902662017339521664675568965516773327",
"4350474591627366416107298296314362336",
"215021478749696396316945991585395029470",
"185450388354206726385921661974436790271",
"165224556441162197129053117928633430985",
"59798747600465045189467767377445470000",
"241163969096571285519004508546979276409",
"85960672197704603622555610117712118698",
"80846150877722837524120323387718541465",
"117835137156639979178723087693212105913",
"60536431756060661774335405013376578376",
"117910110540241473111911991261985674026",
"97771013057993428048414764299475509739"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
"signature_type": "Line",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-9a5dc2fa"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"117162296588913963192368785038390624568",
"307634261829362565021699109295626487122",
"196410445464845262661405074631952134675",
"120049243697650972740132314177496527555",
"128070580493296348325497429624999569801",
"198580463888025138106743828579571251842",
"301145081542719358368817073716020993005",
"301427142021224102750427708011992741204",
"19866045274388517000637112827861157674",
"262341276278426797078287369172075852027",
"269214936570555792287275253079834983838",
"89565200698860100190898665717407457897",
"189058080544817031185572360218574019560",
"103739642753878370504610518275801063764",
"37886385785127333521157900858077273099",
"5424672346043702730892678598506970832",
"17849502913531087632679325642094119449",
"323383003213751167692917648624716845922",
"197314703678427400962082098546842167759"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
"signature_type": "Line",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-9af713f4"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"29185659610122395313861316182551599948",
"119436868407338526164171726990700626976",
"56732596863387622848271761664889032846",
"100687685275960529984236576844682530612",
"55683657426558059997621378749665707871",
"128070580493296348325497429624999569801",
"93118132407902822467016282270837323983",
"64142084060177013999069689214690682927",
"108607330375568690630842167193530272458",
"143601983874706057949628643660203641123",
"19866045274388517000637112827861157674",
"62777374092229266011355360022044508618",
"267028523038001442400666070711576777571",
"86537435192653488410133351022916938448",
"197008865712442448675539927397486278047",
"189058080544817031185572360218574019560",
"103739642753878370504610518275801063764",
"37886385785127333521157900858077273099",
"5424672346043702730892678598506970832",
"52762115694837994875987470896107698878",
"338850284767634062493000214987035870556",
"197314703678427400962082098546842167759"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
"signature_type": "Line",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-a3bd6a43"
},
{
"digest": {
"length": 462.0,
"function_hash": "295386357095718959976635158240553379034"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
"signature_type": "Function",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java",
"function": "downloadFile"
},
"signature_version": "v1",
"id": "CVE-2025-32950-af8c8d7a"
},
{
"digest": {
"length": 1489.0,
"function_hash": "312050956198086913287366940690889687596"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
"signature_type": "Function",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java",
"function": "saveStream"
},
"signature_version": "v1",
"id": "CVE-2025-32950-b1f16392"
},
{
"digest": {
"length": 462.0,
"function_hash": "295386357095718959976635158240553379034"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
"signature_type": "Function",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java",
"function": "downloadFile"
},
"signature_version": "v1",
"id": "CVE-2025-32950-b5dcaa6f"
},
{
"digest": {
"length": 1489.0,
"function_hash": "312050956198086913287366940690889687596"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
"signature_type": "Function",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java",
"function": "saveStream"
},
"signature_version": "v1",
"id": "CVE-2025-32950-dc848ff5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"13932260379203073196704883315444163311",
"69666815674261712627969178036570725708",
"293451950211830567027807347306658154928",
"10037119209135023776777496697266592252",
"223948463021109568288025534070578722639",
"242449441993541853620220015725318120213",
"253233936483156682921607132573067125011",
"89073504890973492284087840584182765851",
"120241825339634219405356938809822259303",
"73537917116907822675211993185235386030"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
"signature_type": "Line",
"target": {
"file": "jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorageProperties.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-eacc120d"
},
{
"digest": {
"length": 462.0,
"function_hash": "295386357095718959976635158240553379034"
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
"signature_type": "Function",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java",
"function": "downloadFile"
},
"signature_version": "v1",
"id": "CVE-2025-32950-f33ed286"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"241990925233922225142782538147660768828",
"64319472664298954843820160959468381720",
"168332195582017150056419384857399325705",
"132431005737998996803440318592634249148",
"79012308002042607670485717261388907055",
"203231841543963653826075079096711956903",
"103678118652843741152354719962469948760",
"239360508747966428823430150290273537103",
"29697553461777364889302067164808960686",
"296539585663304255251970162957197285664",
"226568001056506152004928984460201954806",
"185450388354206726385921661974436790271",
"165224556441162197129053117928633430985",
"59798747600465045189467767377445470000",
"241163969096571285519004508546979276409",
"85960672197704603622555610117712118698",
"80846150877722837524120323387718541465",
"117835137156639979178723087693212105913",
"60536431756060661774335405013376578376",
"117910110540241473111911991261985674026",
"97771013057993428048414764299475509739"
]
},
"deprecated": false,
"source": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
"signature_type": "Line",
"target": {
"file": "jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"
},
"signature_version": "v1",
"id": "CVE-2025-32950-fcaaa24a"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32950.json"
vanir_signatures_modified
"2026-07-22T04:01:55Z"